title: web.xml security constraint combination of roles
body: <p>Given that I cannot create any new role because they are created in a CAS server and I do not have any control over them, is there a way to protect a PDF file to be opened only if a user has both "customer" and "professional" roles?</p>
  
  <p>In other words, considering the following three users:</p>
  
  <p>user1 has only "customer" role
  user2 has "customer" and "professional" roles
  user3 has "customer" and "professional" roles
  user4 has only "professional" role</p>
  
  <p>only user2 and user3 should be allowed to see the PDF.</p>
  
  <p>Basically, I would like to do something like:</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;auth&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/doc/profesionalCustomer.pdf&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;professional,customer&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>Is this even possible?</p>
  
  <p>Thanks in advance</p>