Defining security roles and constraints in the web.xml file

When user role information is required, you must also update the WEB-INF/web.xml file to include security roles and constraints. If the web.xml file does not exist in your project, you must create it first. Then, modify the web.xml file as follows.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" 
     "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app id="WebApp_ID">
    <display-name>YOUR-MANIFEST-SYMBOLNAME</display-name>
    <context-param>
        <param-name>transportSecurityEnabled</param-name>
        <param-value>false</param-value>
        <description>Used to turn off transport-level security. This setting will 
           override the security constraints specified in the web.xml descriptor</description>
    </context-param>
    <servlet>
        <servlet-name>WebSvcHttpServlet</servlet-name>
        <display-name>WebSvcHttpServlet</display-name>
        <servlet-class>com.ibm.pvcws.internal.service.WebSvcHttpServlet</servlet-class> 
    </servlet>
    <servlet-mapping>
        <servlet-name>WebSvcHttpServlet</servlet-name> 
        <url-pattern>/*</url-pattern> 
    </servlet-mapping>
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
        <welcome-file>index.htm</welcome-file>
        <welcome-file>index.jsp</welcome-file>
        <welcome-file>default.html</welcome-file>
        <welcome-file>default.htm</welcome-file>
        <welcome-file>default.jsp</welcome-file>
    </welcome-file-list>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>YOUR-RESOURCE-NAME</web-resource-name>
            <url-pattern>/*</url-pattern>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>YOUR-REQUIRED-ROLE-FOR-THIS-RESOURCE</role-name>
        </auth-constraint>
    </security-constraint>    <login-config>
        <auth-method>BASIC</auth-method>
    </login-config>
    <security-role>
        <role-name>YOUR-ROLE</role-name>
    </security-role></web-app>