<!ELEMENT resources
((custom-resource | external-jndi-resource | jdbc-resource | mail-resource
..
..
- connector-connection-pool)*)>
+ | connector-connection-pool | work-security-map)*)>
+<!-- work-security-map
+ Perform mapping from Principal associated with an incoming Work
+ instance to a Principal in the application server's security domain. The
+ security-map element, on the other hand, performs mapping from
+ Principals in the application server security domain to a Principal
+ accepted by the EIS. It is possible to map multiple EIS Group and/or
+ User Principals to the same application server (server) Principal.
+
+ Used in:
+ resources
+-->
+
+<!ELEMENT work-security-map (description?, (principal-map*, group-map*)+) >
+
+<!ATTLIST work-security-map
+name CDATA #REQUIRED
+resource-adapter-name CDATA #REQUIRED
+object-type %object-type; "user"
+enabled %boolean; "true">
+
+<!-- principal-map
+ Performs mapping from a Principal in the EIS security domain to
+ a Principal accepted by the application server security domain
+
+ attributes
+ eis-principal
+ A Principal in the EIS security domain that is being mapped to
+ a Principal in the application server's security domain.
+ mapped-principal
+ A Principal that is valid in the application server's security domain
+
+ Used in:
+ work-security-map
+-->
+<!ELEMENT principal-map EMPTY >
+
+<!ATTLIST principal-map
+eis-principal CDATA #REQUIRED
+mapped-principal CDATA #REQUIRED>
+
+<!-- group-map
+ Group map to map eis-group name to application server domain's group name
+
+ attributes
+ eis-group
+ A Group in the EIS security domain that is being mapped to
+ a Group in the application server's security domain
+ mapped-group
+ A Group that is valid in the application server's security domain
+
+ Used in:
+ work-security-map
+-->
+<!ELEMENT group-map EMPTY >
+
+<!ATTLIST group-map
+eis-group CDATA #REQUIRED
+mapped-group CDATA #REQUIRED>
+
