Password protecting tomcat web application

Following configuration in web.xml of a web application is useful for password protecting the web application in tomcat servlet engine.

    
    <security-constraint>
      <web-resource-collection>
        <web-resource-name>portalBase Application</web-resource-name>
        <url-pattern>/*</url-pattern>
        <!-- If you list http methods, only those methods are protected -->

 <http-method>DELETE</http-method>

 <http-method>GET</http-method>

 <http-method>POST</http-method>

 <http-method>PUT</http-method>

      </web-resource-collection>
      <auth-constraint>
        <role-name>role1</role-name>

      </auth-constraint>
    </security-constraint>
    <login-config>
      <auth-method>BASIC</auth-method>
      <realm-name>portalBase Application</realm-name>
    </login-config>
    <!-- Security roles referenced by this web application -->
    <security-role>
      <role-name>role1</role-name>
    </security-role>

Update tomcat-users.xml in $CATALINA_HOME/conf directory to associate users with the role.

<?xml version='1.0' encoding='utf-8'?>

<tomcat-users>

<role rolename="tomcat"/>

<role rolename="role1"/>

<role rolename="manager"/>

<role rolename="admin"/>

<user username="tomcat" password="tomcat" roles="tomcat"/>

<user username="role1" password="tomcat" roles="role1"/>

<user username="admin" password="password" roles="admin,manager"/>

</tomcat-users>



Restart the tomcat and try the url to web application. It should pop up a username/password dialog box.