title: Tomcat authentication and specific web app authentication
body: <p>I config my tomcat with the following configuration in the web.xml. So now I secure all webapps in the folder webapps. The user has to authenticate himself, before he can visit the web apps.</p>
  
  <pre><code>&lt;security-constraint&gt;
    &lt;web-resource-collection&gt;
      &lt;web-resource-name&gt;
        My Application
      &lt;/web-resource-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;http-method&gt;GET&lt;/http-method&gt;
      &lt;http-method&gt;PUT&lt;/http-method&gt;
    &lt;/web-resource-collection&gt;
    &lt;auth-constraint&gt;
      &lt;role-name&gt;demo123&lt;/role-name&gt;
      &lt;role-name&gt;admin&lt;/role-name&gt;
    &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;login-config&gt;
    &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
    &lt;realm-name&gt;Secure Apps&lt;/realm-name&gt;
  &lt;/login-config&gt;
  </code></pre>
  
  <p>After the user logged in, he can visit the requested web app. 
  My problem:
  In the web apps the user have to logged in (with Basic authentication), because behind there is a specific server with all server logic. I use REST Webservices to communicate to that server. But I can't call the webservices because it shows me a 401 Unauthorized.
  If I delete the above configuration in the web.xml, I can call these webservices without problems.
  Is there a way to secure all webapps in the tomcat another way? I need it because the webapps needs the basic authentication. </p>
  
  <p>For the applications I use spring framework.</p>