<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="xxx"/>
  ...
  <user username="foo_user" password="foo_password" roles="xxx,yyy"/>
  ...
</tomcat-users>

In the web.xml file of the webapp:

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Basic Authentication</web-resource-name>
            <url-pattern>*</url-pattern> <!-- you can put as many specific patterns as you wish -->
            <http-method>GET</http-method>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>manager</role-name> <!-- this maps to a role in the user xml file -->
        </auth-constraint>
    </security-constraint>

    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>Authentication Area</realm-name>
    </login-config>

    <security-role>
        <role-name>manager</role-name> <!-- this maps to a role in the user xml file; same as above -->
    </security-role>

All comments are moderated

Your comment: