dado um Servlet HelloServlet:

@WebServlet("/HelloServlet")
public class HelloServlet extends HttpServlet {
    private static final long serialVersionUID = 1L;

    /**
     * Default constructor.
     */
    public HelloServlet() {
    // TODO Auto-generated constructor stub
    }


   @Override
    protected void doGet(HttpServletRequest request,
        HttpServletResponse response) throws ServletException, IOException {
    // TODO Auto-generated method stub
    System.out.print("hello my Friend: " + request.getRemoteUser());
    response.setContentType("text/html");
    PrintWriter out = response.getWriter();
    out.println("This is the Test Servlet");

    Enumeration headerNames = request.getHeaderNames();
    while (headerNames.hasMoreElements()) {
        String headerName = (String) headerNames.nextElement();
        out.print("<br/>Header Name: <em>" + headerName);
        String headerValue = request.getHeader(headerName);
        out.print("</em>, Header Value: <em>" + headerValue);
        out.println("</em>");
    }
    }
....
}

com uma política de segurança tomcat declarada no web.xml:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>my application</web-resource-name>
        <url-pattern>/*</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
    </web-resource-collection>

    <auth-constraint>
        <role-name>tomcat</role-name>
    </auth-constraint>
</security-constraint>
<login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
        <form-login-page>/login.jsp</form-login-page>
        <form-error-page>/login-failed.jsp</form-error-page>
    </form-login-config>
</login-config>

e definições de funções do tomcat em conf / tomcat-users.xml

  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>

o reino em "server.xml" é:

  <Realm className="org.apache.catalina.realm.LockOutRealm">
    <!-- This Realm uses the UserDatabase configured in the global JNDI
         resources under the key "UserDatabase".  Any edits
         that are performed against this UserDatabase are immediately
         available for use by the Realm.  -->
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
           resourceName="UserDatabase"/>
  </Realm>

, Eu tentei acessar o Servlet "HelloServlet" com url localhost / jsfWorkgroup / HelloServlet.

como esperado, estou (re) direcionado para a página de login:

<form method="POST" action="j_security_check">
<table>
  <tr>
    <td colspan="2">Login to the Tomcat-Demo application:</td>
  </tr>
  <tr>
    <td>Name:</td>
    <td><input type="text" name="j_username" /></td>
  </tr>
  <tr>
    <td>Password:</td>
    <td><input type="password" name="j_password"/ ></td>
  </tr>
  <tr>
    <td colspan="2"><input type="submit" value="Go" /></td>
  </tr>
</table>
</form>

Não importa qual id-token eu usei:

nome de usuário: tomcat passwort: tomcatnome de usuário: ambos passwort: tomcat

Eu ainda venho para a falha /login-failed.jsp.

Aqui está minha opinião sobre isso: tomcat atua em redirecionar-me para a página de login, mas não lê o conf / tomcat-users.xml para validar meu login (mesmo depois de várias reinicializações).

o que você acha disso ?

configuração: Tomcat 7.0.23, Eclipse-Indigo