<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<remapper-storage>
  <node class="container" name="">
    <node class="container" name="security">
      <node class="container" name="acl">
        <!-- The broker process account may read the accounts subtree (it authenticates
             spawned client sessions). -->
        <node class="container" name="system">
          <node class="container" name="{broker_process_acl}">
            <node class="strings" name="subjects">
              <node-attribute name="values" value="{broker_process_name}"/>
            </node>
            <node class="systemRights" name="rights">
              <node-attribute name="check" value="true"/>
            </node>
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="accounts"/>
              <node-attribute name="reftype" value="TRUE"/>
            </node>
          </node>
        </node>
        <!-- The broker process account is a trusted spawner: it is allowed to launch
             per-session client JVMs as the OS user named by resource-instance/reference
             (= the broker's web/defaultOsUser). Enforced by TrustedSpawnerResource /
             TrustedSpawnerRights, so TrustedSpawnerResource must be registered in the
             base directory's security/config/resource-plugins list. -->
        <node class="container" name="trustedspawner">
          <node class="container" name="{broker_process_acl}">
            <node class="strings" name="subjects">
              <node-attribute name="values" value="{broker_process_name}"/>
            </node>
            <node class="trustedSpawnerRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="{broker_os_user}"/>
              <node-attribute name="reftype" value="TRUE"/>
            </node>
          </node>
        </node>
      </node>
      <node class="container" name="accounts">
        <node class="container" name="processes">
          <node class="process" name="{broker_process_name}">
            <node-attribute name="enabled" value="TRUE"/>
            <node-attribute name="description" value="{broker_process_description}"/>
            <node-attribute name="server" value="FALSE"/>
            <node-attribute name="alias" value="{broker_process_name_alias}"/>
          </node>
        </node>
      </node>
    </node>
    <node class="container" name="server">
      <node class="container" name="default">
        <node class="container" name="brokers">
          <!-- 9709e broker node: broker_account is the process account whose cert this
               broker presents (registration authenticates against it); host is the
               broker's own reachable service name (NEVER localhost); portsRange is the
               per-broker session port window used to build map.clients-to-backends.
               No 'account' child is declared, so this broker serves any user and the
               server selects among brokers by load. -->
          <node class="broker" name="{broker_name}">
            <node-attribute name="broker_account" value="{broker_process_name}"/>
            <node-attribute name="host" value="{broker_host}"/>
            <node class="container" name="portsRange">
              <node class="integer" name="from">
                <node-attribute name="value" value="{from_port}"/>
              </node>
              <node class="integer" name="to">
                <node-attribute name="value" value="{to_port}"/>
              </node>
            </node>
          </node>
        </node>
      </node>
    </node>
  </node>
</remapper-storage>
