Head First Servlets and JSP, 2nd Edition

Authorization Step 1: defining roles

The most common form of authorization in servlets is for the container to determine whether a specific servlet—and the invoking HTTP request method—can be called by a user who has been assigned a certain security “role”. So the first step is to map the roles in the vendor-specific “users” file to roles established in the Deployment Descriptor.

VENDOR-SPECIFIC:

The <role> element in tomcat-users.xml

The deployer creates <role-name> elements in the DD, so that the Container can map roles to users.