title: Container vs Servlet Authentication
body: <p>I am creating a web application using Servlets and JPA. I have a user table that stores usernames,passwords and roles. I would like to create Login and user registration functionality for these users so that some of my content is accessible to certain users.
  As I ready through the Servlet specification and also Tomcat, which is the container I use, I have come across two ways of defining users and roles of the system.</p>
  
  <p>The Tomcat specification suggests I can use Realms to tie into another database so that I can choose to use SSO if I wish. 
  Servlets have their own way of defining users and roles using the web.xml, such as basic authentication for example, so does the Servlet container, using Realms.</p>
  
  <p>But to create users and roles in the Servlet and the Container seems to be something that the system administrator would do. What I am looking for is a self-registration.</p>
  
  <p>This question above highlights my confusion with these approaches, I don’t know if the way I want to proceed is correct or secure?
  Can someone explain the differences between these methods of authentication?
  Why choose one over the other?
  Is my plan to use the self registration a bad idea  or insecure for J2E Model?</p>