Index: src/main/java/org/apache/jackrabbit/core/config/ConfigurationEntityResolver.java
===================================================================
--- src/main/java/org/apache/jackrabbit/core/config/ConfigurationEntityResolver.java	(revision 883695)
+++ src/main/java/org/apache/jackrabbit/core/config/ConfigurationEntityResolver.java	(working copy)
@@ -16,20 +16,21 @@
  */
 package org.apache.jackrabbit.core.config;
 
-import org.xml.sax.EntityResolver;
-import org.xml.sax.InputSource;
-import org.xml.sax.SAXException;
-
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.HashMap;
 import java.util.Map;
 
+import org.xml.sax.EntityResolver;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+
 /**
  * Entity resolver for Jackrabbit configuration files.
  * This simple resolver contains mappings for the following
  * public identifiers used for the Jackrabbit configuration files:
  * <ul>
+ * <li><code>-//The Apache Software Foundation//DTD Jackrabbit 2.0//EN</code></li>
  * <li><code>-//The Apache Software Foundation//DTD Jackrabbit 1.6//EN</code></li>
  * <li><code>-//The Apache Software Foundation//DTD Jackrabbit 1.5//EN</code></li>
  * <li><code>-//The Apache Software Foundation//DTD Jackrabbit 1.4//EN</code></li>
@@ -39,6 +40,7 @@
  * <p>
  * Also the following system identifiers are mapped to local resources:
  * <ul>
+ * <li><code>http://jackrabbit.apache.org/dtd/repository-2.0.dtd</code></li>
  * <li><code>http://jackrabbit.apache.org/dtd/repository-1.6.dtd</code></li>
  * <li><code>http://jackrabbit.apache.org/dtd/repository-1.5.dtd</code></li>
  * <li><code>http://jackrabbit.apache.org/dtd/repository-1.4.dtd</code></li>
@@ -71,6 +73,14 @@
      * Creates the singleton instance of this class.
      */
     private ConfigurationEntityResolver() {
+        // Apache Jackrabbit 2.0 DTD
+        publicIds.put(
+                "-//The Apache Software Foundation//DTD Jackrabbit 2.0//EN",
+                "repository-2.0.dtd");
+        systemIds.put(
+                "http://jackrabbit.apache.org/dtd/repository-2.0.dtd",
+                "repository-2.0.dtd");
+
         // Apache Jackrabbit 1.6 DTD
         publicIds.put(
                 "-//The Apache Software Foundation//DTD Jackrabbit 1.6//EN",
@@ -78,7 +88,7 @@
         systemIds.put(
                 "http://jackrabbit.apache.org/dtd/repository-1.6.dtd",
                 "repository-1.6.dtd");
-        
+
         // Apache Jackrabbit 1.5 DTD
         publicIds.put(
                 "-//The Apache Software Foundation//DTD Jackrabbit 1.5//EN",
Index: src/main/resources/org/apache/jackrabbit/core/config/repository-2.0.dtd
===================================================================
--- src/main/resources/org/apache/jackrabbit/core/config/repository-2.0.dtd	(revision 881285)
+++ src/main/resources/org/apache/jackrabbit/core/config/repository-2.0.dtd	(working copy)
@@ -75,7 +75,7 @@
     used by this repository instance; the class attribute specifies the FQN of the
     class implementing the JackrabbitSecurityManager interface
 -->
-<!ELEMENT SecurityManager (WorkspaceAccessManager?, param*)>
+<!ELEMENT SecurityManager (WorkspaceAccessManager?,UserManager?,UserIdClass?, param*)>
 <!ATTLIST SecurityManager class CDATA #REQUIRED
                           workspaceName CDATA #IMPLIED>
 
@@ -141,7 +141,7 @@
     it is used to create the initial workspace if there's no workspace yet
     and for creating additional workspaces through the api
 -->
-<!ELEMENT Workspace (FileSystem,PersistenceManager,SearchIndex?,ISMLocking?,WorkspaceSecurity?)>
+<!ELEMENT Workspace (FileSystem,PersistenceManager,SearchIndex?,ISMLocking?,WorkspaceSecurity?,Import?)>
 <!ATTLIST Workspace name CDATA #REQUIRED>
 
 <!--
@@ -227,3 +227,44 @@
 -->
 <!ELEMENT DataStore (param*)>
 <!ATTLIST DataStore class CDATA #REQUIRED>
+
+<!--
+    The Import element configures how protected items are imported into a
+    workspace.
+-->
+<!ELEMENT Import (ProtectedNodeImporter|ProtectedPropertyImporter)*>
+
+<!--
+    The ProtectedNodeImporter element configures an importer for protected
+    nodes. The class attribute specifies the FQN of the class implementing the
+    ProtectedNodeImporter interface.
+    The param(s) define implementation specific parameters.
+-->
+<!ELEMENT ProtectedNodeImporter (param*)>
+<!ATTLIST ProtectedNodeImporter class CDATA #REQUIRED>
+
+<!--
+    The ProtectedPropertyImporter element configures an importer for protected
+    properties. The class attribute specifies the FQN of the class implementing
+    the ProtectedPropertyImporter interface.
+    The param(s) define implementation specific parameters.
+-->
+<!ELEMENT ProtectedPropertyImporter (param*)>
+<!ATTLIST ProtectedPropertyImporter class CDATA #REQUIRED>
+
+<!--
+    The UserManager element configures the user manager implementation that is
+    used in Jackrabbit. The class attribute specifies the FQN of the class
+    implementing the UserManager interface.
+    The param(s) define implementation specific parameters.
+-->
+<!ELEMENT UserManager (param*)>
+<!ATTLIST UserManager class CDATA #REQUIRED>
+
+<!--
+    The UserIdClass element specifies the class of principals used to retrieve
+    the userID out of a Subject. The class attribute specifies the FQN of a
+    class implementing the java.security.Principal interface.
+-->
+<!ELEMENT UserIdClass EMPTY>
+<!ATTLIST UserIdClass class CDATA #REQUIRED>