Summary of syntax rules

control-cookie            = control-cookie-name "=" control-cookie-value
control-cookie-name       = "AL_CONTROL"
control-cookie-value      = commands
                            ;at this place 'commands' must be percent encoded

commands                  = command [ "&" commands ]
command                   = audit-token-command | basic-auth-command | credential-command | header-command
                                | kerberos-user-command | ntlm-command | session-command | timeout-command | tracking-command
                                | auth-workflow-command | session-variable-command

;; AUDIT_TOKEN
audit-token-command       = audit-token-command-name "=" audit-token-command-value
audit-token-command-name  = "AUDIT_TOKEN"
audit-token-command-value = audit-token-value
                            ;at this place 'audit-token-value' must be percent encoded

;; HTTP_BASIC_AUTH
basic-auth-command        = basic-auth-command-name "=" basic-auth-command-value
basic-auth-command-name   = "HTTP_BASIC_AUTH"
basic-auth-command-value  = basic-auth-definitions
basic-auth-definitions    = basic-auth-definition [ "," basic-auth-definitions ]
basic-auth-definition     = basic-auth-value [ "@" mapping-name ]
                            ;at this place 'basic-auth-value' must be percent encoded

;; HTTP_NTLM
ntlm-command              = ntlm-command-name "=" ntlm-command-value
ntlm-command-name         = "HTTP_NTLM"
ntlm-command-value        = ntlm-definitions
ntlm-definitions          = ntlm-definition [ "," ntlm-definitions ]
ntlm-definition           = ntlm-value [ "@" mapping-name ]
                            ;at this place 'ntlm-value' must be percent encoded

;; SET_CREDENTIALS, ADD_CREDENTIALS, REMOVE_CREDENTIALS
credential-command        = credential-command-name "=" credential-command-value
credential-command-name   = "SET_CREDENTIALS" | "ADD_CREDENTIALS" | "REMOVE_CREDENTIALS"
credential-command-value  = credential-definitions
                            ;at this place 'credential-definitions' must be percent encoded

credential-definitions    = credential-definition [ "," credential-definitions ]
credential-definition     = credential-name [ ":" credential-timeout [ ":" credential-lifetime [ ":" keep-id-flag ] ] ]
credential-name           = 1*ALPHANUM
credential-timeout        = value-in-seconds
credential-lifetime       = value-in-seconds
keep-id-flag              = "K"
value-in-seconds          = 1*DIGIT
ALPHANUM                  = ALPHA | DIGIT

;; SET_HEADERS, ADD_HEADERS, REMOVE_HEADERS
header-command            = header-command-name "=" header-command-value
header-command-name       = "SET_HEADERS" | "ADD_HEADERS" | "REMOVE_HEADERS"
header-command-value      = header-command-for-mapping-values
header-command-for-mapping-values = [ header-command-for-mapping-value [ "," header-command-for-mapping-values ] ]
header-command-for-mapping-value = header-definition [ "@" mapping-name ]
                                   ;at this place 'header-definition' must be percent encoded

header-definition         = header-name ":" *SP header-value

;; KERB_USER
kerberos-user-command       = kerberos-user-command-name "=" kerberos-user-command-value
kerberos-user-command-name  = "KERB_USER"
kerberos-user-command-value = kerberos-user-values
kerberos-user-values        = kerberos-user-value [ "," kerberos-user-values ]
kerberos-user-value         = percent-encoded-domain-and-user [ "@" [ mapping-name ] ]
domain-and-user             = [ domain ] "\" [ user ]

;; SESSION
session-command           = current-session-command | foreign-session-command
current-session-command   = session-command-name "=" current-session-command-value
session-command-name      = "SESSION"
current-session-command-value = "TERMINATE" | "NEWID" | "NEW" | "CLEAR"

;; SESSION[sid:{foreign session id}]
session-command           = current-session-command | foreign-session-command
foreign-session-command   = session-command-name "[sid:" foreign-session-id "]" "=" foreign-session-command-value
session-command-name      = "SESSION"
foreign-session-id        = 1*ALPHANUM
foreign-session-command-value = "TERMINATE"
ALPHANUM                  = ALPHA | DIGIT

;; SESSION_TIMEOUT
timeout-command           = timeout-command-name "=" timeout-command-value
timeout-command-name      = "SESSION_TIMEOUT"
timeout-command-value     = value-in-seconds
value-in-seconds          = 1*DIGIT

;; SESSION_TRACKING_MODE
tracking-command          = tracking-command-name "=" tracking-command-value
tracking-command-name     = "SESSION_TRACKING_MODE"
tracking-command-value    = "SSL" | "COOKIE"

;; AUTH_WORKFLOW
auth-workflow-command     = auth-workflow-command-name "=" auth-workflow-command-value
auth-workflow-command-name  = "AUTH_WORKFLOW"
auth-workflow-command-value = "FINAL_RESPONSE" | "CONTINUE"

;; SET_SESSION_VARIABLES, ADD_SESSION_VARIABLES, REMOVE_SESSION_VARIABLES
session-variable-command       = session-variable-command-name "=" session-variable-command-value
session-variable-command-name  = "SET_SESSION_VARIABLES" | "ADD_SESSION_VARIABLES" | "REMOVE_SESSION_VARIABLES"
session-variable-command-value = session-variable-definitions
session-variable-definitions   = session-variable-definition [ "," session-variable-definitions ]
                                 ;at this place each 'session-variable-definition' must be percent encoded
session-variable-definition    = session-variable-name [ "=" session-variable-value ]