title: How to configure glassfish 3.1 security file realm using Netbeans 7.1?
body: <p>I am trying to configure a simple file realm in glassfish 3.1 following this <a href="http://www.jairrillo.com/blog/2009/08/16/jee-security-how-to-setup-authentication-on-glassfish-and-netbeans/" rel="nofollow noreferrer">tutorial</a>:</p>
  
  <p>I did everything as it says but doesn't work, when I travel to the admin page doesn't I don't see the pop up message asking for credentials.
  This is what I did:</p>
  
  <p><strong>1- Create a file realm:</strong>
  <img src="https://i.stack.imgur.com/M1MIZ.jpg" alt="enter image description here"></p>
  
  <p><strong>2- Then I created a user using the manage users button</strong>
  <img src="https://i.stack.imgur.com/ojWvL.jpg" alt="enter image description here"></p>
  
  <p><strong>3-I created a glassfish-web.xml file using the graphic interface instead of the editors</strong>
  <img src="https://i.stack.imgur.com/tyN73.jpg" alt="enter image description here"></p>
  
  <p><strong>4-Then in the same way I configured the web.xml</strong>
  <img src="https://i.stack.imgur.com/rCj0m.jpg" alt="enter image description here">
  Sorry if this last image is a bit hard to see, you can zoom.</p>
  
  <p>When I use the URL to travel to /admin.xhtml nothing stops me from viewing the content of the page, this means something is not configured right.
  I don't know what am I missing.
  Could somebody give me a hand trying to find the reason I cannot make this simple security task work?</p>
  
  <p><strong>Update</strong></p>
  
  <p>Here my web.xml source</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
      &lt;context-param&gt;
          &lt;param-name&gt;javax.faces.PROJECT_STAGE&lt;/param-name&gt;
          &lt;param-value&gt;Development&lt;/param-value&gt;
      &lt;/context-param&gt;
      &lt;servlet&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;servlet-class&gt;javax.faces.webapp.FacesServlet&lt;/servlet-class&gt;
          &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
      &lt;/servlet&gt;
      &lt;servlet-mapping&gt;
          &lt;servlet-name&gt;Faces Servlet&lt;/servlet-name&gt;
          &lt;url-pattern&gt;/faces/*&lt;/url-pattern&gt;
      &lt;/servlet-mapping&gt;
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;faces/index.xhtml&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
      &lt;security-constraint&gt;
          &lt;display-name&gt;Constraint1&lt;/display-name&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;allowed&lt;/web-resource-name&gt;
              &lt;description/&gt;
              &lt;url-pattern&gt;/admin.xhtml&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;description/&gt;
              &lt;role-name&gt;administrator&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
      &lt;login-config&gt;
          &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
          &lt;realm-name&gt;file&lt;/realm-name&gt;
      &lt;/login-config&gt;
      &lt;security-role&gt;
          &lt;description/&gt;
          &lt;role-name&gt;administrator&lt;/role-name&gt;
      &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>and also glassfish-web.xml source</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd"&gt;
  &lt;glassfish-web-app error-url=""&gt;
    &lt;security-role-mapping&gt;
      &lt;role-name&gt;administrator&lt;/role-name&gt;
      &lt;group-name&gt;admin&lt;/group-name&gt;
    &lt;/security-role-mapping&gt;
    &lt;class-loader delegate="true"/&gt;
    &lt;jsp-config&gt;
      &lt;property name="keepgenerated" value="true"&gt;
        &lt;description&gt;Keep a copy of the generated servlet class' java code.&lt;/description&gt;
      &lt;/property&gt;
    &lt;/jsp-config&gt;
  &lt;/glassfish-web-app&gt;
  </code></pre>
  
  <p>Basically what I want to do is having 2 types of users. Guests who just browse index.xhtml and they have no credentials at all and the administrators who have their credentials stored in the file and are asked for them when going to admin.xhtml</p>
  
  <p>I don't understand what is missing. Do I need to create special privilege for guest users saying that they can view index.xhtml?</p>