title: Security constraint in web.xml for authenticated users without role memberships
body: <p>I am quite desperate, because I think there must be an easy solution to my problem but I am searching - to no avail.</p>
  
  <p>I am using a custom Realm in Glassfish 3.1.1. This custom realm (implements AppservPasswordLoginModuleInterface) takes a security token from the HTTPS request, validates the security token and then returns the user to Glassfish.</p>
  
  <p>The problem is that the security token does not contain any groups, meaning that the method public String[] getGroupsList() or the custom realm returns an empty list (correctly, because there are no roles in the security token).</p>
  
  <p>That said, I would like to have a security contraint that only validated users can login. I know that I can use the following constraint in web.xml:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;security-constraint&gt;
    &lt;web-resource-collection&gt;
      &lt;web-resource-name&gt;mywebapp&lt;/web-resource-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/web-resource-collection&gt;
    &lt;auth-constraint&gt;
      &lt;role-name&gt;Users&lt;/role-name&gt;
    &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>But because I don't have any groups, I cannot map any groups to roles, and therefore I cannot use the auth-constraint with role-name. </p>
  
  <p>Is there a way in web.xml to define that only authenticated users are allowed, ignoring in which role they are and ignoring whether they are in any role at all.</p>
  
  <p>There are a couple of solutions which I cannot implement:</p>
  
  <ul>
  <li>I cannot change the underlying LDAP to include roles, because the LDAP schema and the way how LDAP users are mapped to security tokens our out of scope.</li>
  <li>I have to use the current custom realm handler, I cannot replace it with one of my own which just returns a default group. I did try this once, and it worked. But I cannot replace the existing custom realm with my own because the custom realm should be generic.  </li>
  </ul>
  
  <p>But I really think there should be a way in web.xml just to say: Ignore all groups and roles, I just want an authenticated user?</p>
  
  <p>Any help would be appreciated.</p>