Index: win_installer/installer/templates/server.xml
===================================================================
diff -u -r388ec3500ab44f8bbd700dee150266ddf40ca53e -r6bea96a2ac932bc49e6f7dfa37b890d8dc1ce149
--- win_installer/installer/templates/server.xml	(.../server.xml)	(revision 388ec3500ab44f8bbd700dee150266ddf40ca53e)
+++ win_installer/installer/templates/server.xml	(.../server.xml)	(revision 6bea96a2ac932bc49e6f7dfa37b890d8dc1ce149)
@@ -1,29 +1,29 @@
 <Server>
 
-   <!-- Use a custom version of StandardService that allows the
-   connectors to be started independent of the normal lifecycle
-   start to allow web apps to be deployed before starting the
-   connectors.
-   -->
-   <Service name="jboss.web"
-      className="org.jboss.web.tomcat.tc5.StandardService">
+   <!-- Optional listener which ensures correct init and shutdown of APR,
+        and provides information if it is not installed -->
+   <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+   <!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
+   <Listener className="org.apache.catalina.core.JasperListener" />
 
-      <!-- A HTTP/1.1 Connector on port 8080 -->
-      <Connector port="@LAMS_PORT@" address="${jboss.bind.address}"
-         maxThreads="250" strategy="ms" maxHttpHeaderSize="8192"
-         emptySessionPath="true"
-         enableLookups="false" redirectPort="8443" acceptCount="100"
-         connectionTimeout="20000" disableUploadTimeout="true"/>
+   <Service name="jboss.web">
 
+      <!-- A HTTP/1.1 Connector on port @LAMS_PORT@ -->
+      <Connector protocol="HTTP/1.1" port="@LAMS_PORT@" address="${jboss.bind.address}" URIEncoding="UTF-8" 
+               connectionTimeout="20000" redirectPort="8443" />
+
+      <!-- Add this option to the connector to avoid problems with 
+          .NET clients that don't implement HTTP/1.1 correctly 
+         restrictedUserAgents="^.*MS Web Services Client Protocol 1.1.4322.*$"
+      -->
+
       <!-- A AJP 1.3 Connector on port 8009 -->
-      <Connector port="8009" address="${jboss.bind.address}"
-         emptySessionPath="true" enableLookups="false" redirectPort="8443" 
-         protocol="AJP/1.3"/>
+      <Connector protocol="AJP/1.3" port="8009" address="${jboss.bind.address}"
+         redirectPort="8443" />
 
       <!-- SSL/TLS Connector configuration using the admin devl guide keystore
-      <Connector port="8443" address="${jboss.bind.address}"
-           maxThreads="100" strategy="ms" maxHttpHeaderSize="8192"
-           emptySessionPath="true"
+      <Connector protocol="HTTP/1.1" SSLEnabled="true" 
+           port="8443" address="${jboss.bind.address}"
            scheme="https" secure="true" clientAuth="false" 
            keystoreFile="${jboss.server.home.dir}/conf/chap8.keystore"
            keystorePass="rmi+ssl" sslProtocol = "TLS" />
@@ -36,91 +36,142 @@
          - certificatePrincipal : the class name of the
          org.jboss.security.auth.certs.CertificatePrincipal impl
          used for mapping X509[] cert chains to a Princpal.
+         - allRolesMode : how to handle an auth-constraint with a role-name=*,
+         one of strict, authOnly, strictAuthOnly
+           + strict = Use the strict servlet spec interpretation which requires
+           that the user have one of the web-app/security-role/role-name
+           + authOnly = Allow any authenticated user
+           + strictAuthOnly = Allow any authenticated user only if there are no
+           web-app/security-roles
          -->
-         <Realm className="org.jboss.web.tomcat.security.JBossSecurityMgrRealm"
+         <Realm className="org.jboss.web.tomcat.security.JBossWebRealm"
             certificatePrincipal="org.jboss.security.auth.certs.SubjectDNMapping"
+            allRolesMode="authOnly"
             />
          <!-- A subclass of JBossSecurityMgrRealm that uses the authentication
          behavior of JBossSecurityMgrRealm, but overrides the authorization
          checks to use JACC permissions with the current java.security.Policy
          to determine authorized access.
+         - allRolesMode : how to handle an auth-constraint with a role-name=*,
+         one of strict, authOnly, strictAuthOnly
+           + strict = Use the strict servlet spec interpretation which requires
+           that the user have one of the web-app/security-role/role-name
+           + authOnly = Allow any authenticated user
+           + strictAuthOnly = Allow any authenticated user only if there are no
+           web-app/security-roles
          <Realm className="org.jboss.web.tomcat.security.JaccAuthorizationRealm"
             certificatePrincipal="org.jboss.security.auth.certs.SubjectDNMapping"
+            allRolesMode="authOnly"
             />
          -->
 
-         <Host name="localhost"
-            autoDeploy="false" deployOnStartup="false" deployXML="false">
+         <Host name="localhost"> 
 
             <!-- Uncomment to enable request dumper. This Valve "logs interesting 
                  contents from the specified Request (before processing) and the 
                  corresponding Response (after processing). It is especially useful 
                  in debugging problems related to headers and cookies."
             -->
-            <!--
+            <!-- 
             <Valve className="org.apache.catalina.valves.RequestDumperValve" />
-            -->
+           	-->
  
             <!-- Access logger -->
-            <Valve className="org.apache.catalina.valves.FastCommonAccessLogValve"
+
+            <Valve className="org.apache.catalina.valves.AccessLogValve"
                 prefix="localhost_access_log." suffix=".log"
-                pattern="common" directory="${jboss.server.home.dir}/log" 
+                pattern="combined" directory="${jboss.server.log.dir}" 
                 resolveHosts="false" />
 
             <!-- Uncomment to enable single sign-on across web apps
                 deployed to this host. Does not provide SSO across a cluster.     
             
                 If this valve is used, do not use the JBoss ClusteredSingleSignOn 
-                valve shown below. 
+                valve shown below.
+                
+                A new configuration attribute is available beginning with
+                release 4.0.4:
+                
+                cookieDomain  configures the domain to which the SSO cookie
+                              will be scoped (i.e. the set of hosts to
+                              which the cookie will be presented).  By default
+                              the cookie is scoped to "/", meaning the host
+                              that presented it.  Set cookieDomain to a
+                              wider domain (e.g. "xyz.com") to allow an SSO
+                              to span more than one hostname.
              -->
-            <!--
+                    <!--
+ 			 
             <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-            -->
-
+			-->
             <!-- Uncomment to enable single sign-on across web apps
-               deployed to this host AND to all other hosts in the cluster
-               with the same virtual hostname.
+               deployed to this host AND to all other hosts in the cluster.
             
                If this valve is used, do not use the standard Tomcat SingleSignOn
                valve shown above.
             
-               This valve uses JGroups to communicate across the cluster.  The 
-               JGroups Channel used for this communication can be configured
-               by editing the "sso-channel.xml" file found in the same folder
-               as this file.  If this valve is running on a machine with multiple
-               IP addresses, configuring the "bind_addr" property of the JGroups
-               UDP protocol may be necessary.  Another possible configuration 
-               change would be to enable encryption of intra-cluster communications.
-               See the sso-channel.xml file for more details.
+               Valve uses a JBossCache instance to support SSO credential 
+               caching and replication across the cluster.  The JBossCache 
+               instance must be configured separately.  See the 
+               "jboss-web-clusteredsso-beans.xml" file in the 
+               server/all/deploy directory for cache configuration details.
             
                Besides the attributes supported by the standard Tomcat
-               SingleSignOn valve (see the Tomcat docs), this version also supports 
-               the following attribute:
+               SingleSignOn valve (see the Tomcat docs), this version also 
+               supports the following attributes:
             
-               partitionName     the name of the cluster partition in which 
-                                 this node participates.  If not set, the default
-                                 value is "sso-partition/" + the value of the
-                                 "name" attribute of the Host element that
-                                 encloses this element (e.g. "sso-partition/localhost")
+               cookieDomain   see non-clustered valve above
+               
+               cacheConfig    Name of the CacheManager service configuration
+                              to use for the clustered SSO cache. See
+                              deploy/cluster/jboss-cache-manager.sar/META-INF/jboss-cache-manager-jboss-beans.xml
+                              Default is "clustered-sso".
+               
+               treeCacheName  Deprecated. Use "cacheConfig". 
+                              JMX ObjectName of the JBoss Cache MBean used to 
+                              support credential caching and replication across
+                              the cluster. Only used if no cache can be located
+                              from the CacheManager service using the "cacheConfig"
+                              attribute (or its default value). If not set, the 
+                              default is "jboss.cache:service=TomcatClusteringCache"
+                              
+               maxEmptyLife   The maximum number of seconds an SSO with no 
+                              active sessions will be usable by a request
+                              
+               processExpiresInterval The minimum number of seconds between 
+                              efforts by the valve to find and invalidate 
+                              SSO's that have exceeded their 'maxEmptyLife'. 
+                              Does not imply effort will be spent on such
+                      			cleanup every 'processExpiresInterval'.
             -->
             <!--
-            <Valve className="org.jboss.web.tomcat.tc5.sso.ClusteredSingleSignOn" />
-            -->
+            <Valve className="org.jboss.web.tomcat.service.sso.ClusteredSingleSignOn" />
+           	-->
          
-            <!-- Uncomment to check for unclosed connections and transaction terminated checks
+            <!-- Check for unclosed connections and transaction terminated checks
                  in servlets/jsps.
-                 Important: You need to uncomment the dependency on the CachedConnectionManager
-                            in META-INF/jboss-service.xml
-            <Valve className="org.jboss.web.tomcat.tc5.jca.CachedConnectionValve"
+                 
+                 Important: The dependency on the CachedConnectionManager
+                 in META-INF/jboss-service.xml must be uncommented, too
+           
+
+            <Valve className="org.jboss.web.tomcat.service.jca.CachedConnectionValve"
                 cachedConnectionManagerObjectName="jboss.jca:service=CachedConnectionManager"
                 transactionManagerObjectName="jboss:service=TransactionManager" />
             -->
-            <!-- LAMS Login Request Valve -->
+            
+    		<!-- LAMS Login Request Valve -->
 			<Valve className="org.lamsfoundation.lams.integration.security.LoginRequestValve" />
 			
+			<!-- LAMS Single Sing On.
+				 The only difference from org.apache.catalina.authenticator.SingleSignOn,
+				 which can be enable above, is that removes some debugging info.
+				 Still, LAMS Valve does the trick and the base Valve does not...
+				 This case will be investigated in the future.
+			-->
 			<Valve className="org.lamsfoundation.lams.integration.security.SingleSignOn" debug="0"/>
+       
          </Host>
-
       </Engine>
 
    </Service>