From the spec:
<!--
The res-auth element specifies whether the enterprise bean code signs
on programmatically to the resource manager, or whether the Container
will sign on to the resource manager on behalf of the enterprise bean.
In the latter case, the Container uses information that is supplied by
the Deployer.
The value of this element must be one of the two following:
<res-auth>Application</res-auth>
<res-auth>Container</res-auth>
-->
<!ELEMENT res-auth (#PCDATA)>