title: <security-constraint> <url-pattern> and the * character within web.xml
body: <p>Useing Spring for Security, I can get the program running using the following code.</p>
  
  <pre><code>&lt;intercept-url pattern="/web/admin**/**" access="ROLE_ADMIN" requires-channel="https"/&gt;
  &lt;intercept-url pattern="/web/**/" access="ROLE_USER,ROLE_ADMIN" requires-channel="https"/&gt;
  </code></pre>
  
  <p>I am trying to do this within a web.xml currently.  Using JBOSS to deploy a .war file.  Below is what I have, The url-pattern is what is causing me the problems in the first security-constraint.  The pages are located at, and named /web/adminarchive   /web/adminsettings     /web/adminstuff   etc...
  The code above within Spring handled it the way I want, with the url being /web/admin**/** to catch all admin pages.  I commented out the /* section, since I know it works, leaving just the admin one.  Using that structure throws no errors, it just doesn't prompt for login at all.</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Name&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/web/admin**/**&lt;/url-pattern&gt;
          &lt;http-method&gt;GET&lt;/http-method&gt;
          &lt;http-method&gt;POST&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;ROLE_ADMIN&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Name&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;http-method&gt;GET&lt;/http-method&gt;
          &lt;http-method&gt;POST&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;ROLE_USER&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>