<tomcat-users> 
    <!-- 
  NOTE:  By default, no user is included in the "manager-gui" role required 
  to operate the "/manager/html" web application.  If you wish to use this app, 
  you must define such a user - the username and password are arbitrary. 
--> 
    <!-- 
  NOTE:  The sample user and role entries below are wrapped in a comment 
  and thus are ignored when reading this file. Do not forget to remove 
  <!.. ..> that surrounds them. 
--> 
    <!-- 
  <role rolename="tomcat"/> 
  <role rolename="role1"/> 
  <user username="tomcat" password="tomcat" roles="tomcat"/> 
  <user username="both" password="tomcat" roles="tomcat,role1"/> 
  <user username="role1" password="tomcat" roles="role1"/> 
--> 
  <role rolename="manager"/> 
  <role rolename="admin"/> 
  <role rolename="manager-script"/> 
  <role rolename="tomcat"/> 
<role rolename="admin-gui"/> 
<role rolename="manager-gui"/> 
  <user username="admin" password="123" roles="manager,admin,manager-script,admin-gui,manager-gui"/> 

</tomcat-users> 

<?xml version="1.0" encoding="UTF-8"?> 
<web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"> 
    <session-config> 
        <session-timeout> 
            30 
        </session-timeout> 
    </session-config> 
    <security-constraint> 
<web-resource-collection> 
<web-resource-name>PartNos</web-resource-name> 
<url-pattern>/TNR/*</url-pattern> 
<http-method>GET</http-method> 
<http-method>POST</http-method> 
</web-resource-collection> 
<auth-constraint> 
<role-name>admin</role-name> 
<role-name>secureconn</role-name> 
</auth-constraint> 
<user-data-constraint> 
<transport-guarantee>CONFIDENTIAL</transport-guarantee> 
</user-data-constraint> 
</security-constraint> 

<security-role> 
<role-name>converter-api</role-name> 
</security-role> 
<security-role> 
<role-name>secureconn</role-name> 
</security-role> 
<security-role> 
<role-name>admin</role-name> 
</security-role> 

<security-constraint> 
<web-resource-collection> 
<web-resource-name>PartNoSecure</web-resource-name> 
<url-pattern>/TNR/*</url-pattern> 
</web-resource-collection> 
<auth-constraint> 
<role-name>secureconn</role-name> 
<role-name>admin</role-name> 
</auth-constraint> 
</security-constraint> 

<login-config> 
<auth-method>CLIENT-CERT</auth-method> 
</login-config> 
</web-app>