title: Servlet - isUserInRole()
body: <p><strong>Spec:</strong></p>
  
  <p>Servlet: 3.0<br>
  Java: 7<br>
  Tomcat: 7.0.54</p>
  
  <p><strong>Intro:</strong></p>
  
  <p>It is possible to check programatically if user has a specific role using method <em>HttpServletRequest.isUserInRole()</em></p>
  
  <p>For example:</p>
  
  <pre class="lang-java prettyprint-override"><code>public void doGet(HttpServletRequest request, HttpServletResponse response) 
      throws IOException, ServletException{
  
      String username = null;
      String password = null;
  
      //get username and password manually from Authorization header
      //...
      request.login(username, password);
  
      if (request.isUserInRole("boss")) {
          //do something
      } else {
          //do something else
      }
  
      request.logout();
  
  }
  </code></pre>
  
  <p>This works fine, but this solution requires to manually retrieve username and password from Authorization header and then login using these credentials.</p>
  
  <p><strong>Questions:</strong></p>
  
  <p>Is it possible to just do something like that? With no retrieving data from header and manually login()?</p>
  
  <pre class="lang-java prettyprint-override"><code>public void doGet(HttpServletRequest request, HttpServletResponse response) 
      throws IOException, ServletException{
  
      if (request.isUserInRole("boss")) {
          //do something
      } else {
          //do something else
      }
  
  }
  </code></pre>
  
  <p><strong>Trying to answer myself:</strong></p>
  
  <p>From my understanding this code requires proper configuration in web.xml. This example works with this configuration in web.xml file, for example:</p>
  
  <pre><code>&lt;web-app ...&gt;
      ...
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;url-pattern&gt;/HelloWorld&lt;/url-pattern&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;boss&lt;/role-name&gt;
              &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;login-config&gt;
          &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
          &lt;realm-name&gt;DefaultRealm&lt;/realm-name&gt;
      &lt;/login-config&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>But this means that programatically checking roles is not required since configuration in web.xml it is all we need to restrict access. </p>
  
  <p><strong>Summary:</strong></p>
  
  <ul>
  <li>is it possible to programatically checking roles without specifing restrictions (auth-constraint) in web.xml?</li>
  <li>if not, does this mean, that using <em>isCallerInRole()</em> performing only checking for additional roles, becouse main required role is specified in web.xml?</li>
  </ul>
  
  <p>Thanks. </p>
  
  <p><strong>Edit 1:</strong><br>
  Since the first answer suggest adding <em>login-config</em> element to my web.xml, I must say I already have it. I added this to code snippet, as I didn't include it when posting question. And example works with this configuration. But when I remove <em>auth-constraint</em> or the whole <em>security-constraint</em>, presence of <em>login-config</em> is not enought.
  I added info about container: Tomcat 7.0.54.</p>