title: How to fix Tomcat access to the requested resouce which has been denied?
body: <p><strong>Update: The code works correctly when the <code>&lt;auth-constraint&gt;</code> element is removed completely. Can anyone explain why it doesn't work when present?</strong></p>
  
  <p>I'm writing some code to practice securing a servlet in the deployment descriptor, and I'm getting the following in the browser:</p>
  
  <pre><code>HTTP Status 403 - Access to the requested resource has been denied
  type Status report
  message Access to the requested resource has been denied
  description Access to the specified resource has been forbidden.
  Apache Tomcat/7.0.42
  </code></pre>
  
  <p>Any thoughts as to what I'm doing wrong? I've done some searching through prior posts, and it seems as though there may have been updates to the role names in Tomcat 7 - I've played with this, but with no success so far. (Code below).</p>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" ?&gt;
  &lt;web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" 
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee    
  http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;CheckedServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;webcert.ch05.ex0502J.CheckedServlet&lt;/servlet-class&gt;
      &lt;security-role-ref&gt;
          &lt;role-name&gt;MGR&lt;/role-name&gt;
          &lt;role-link&gt;manager&lt;/role-link&gt;
      &lt;/security-role-ref&gt;
  &lt;/servlet&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;CheckedServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/CheckedServlet&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;CheckedServletConstraint&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/CheckedServlet&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;*&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;manager&lt;/role-name&gt;
  &lt;/security-role&gt;
  </code></pre>
  
  <p></p>
  
  <p><strong>CheckedServlet.java</strong></p>
  
  <pre><code>package webcert.ch05.ex0502J;
  import java.io.*;
  import javax.servlet.*;
  import javax.servlet.http.*;
  import java.security.*;
  
  public class CheckedServlet extends HttpServlet{
  
  protected void doPost(HttpServletRequest request, HttpServletResponse response) 
          throws ServletException, IOException {
      doGet(request, response);
  }
  protected void doGet(HttpServletRequest request, HttpServletResponse response)
          throws ServletException, IOException{
  
      response.setContentType("text/html");
      PrintWriter out = response.getWriter();
      out.write("&lt;html&gt;&lt;head&gt;&lt;title&gt;CheckedServlet&lt;/title&gt;&lt;/head&gt;&lt;body&gt;");
  
      String userMessage;
      Principal user = request.getUserPrincipal();
      if(user == null)
          userMessage = "Access denied.";
      else
          userMessage = "Access granted.";
  
      out.write("&lt;br&gt;" + userMessage + " Principal name is " + user +
                "&lt;br&gt;If authorized, you should see some more text below:");
  
      if(request.isUserInRole("manager"))
          out.write("&lt;br&gt;Here's some super secret extra text since your " +
                  "role is manager.");
  
      out.write("&lt;/body&gt;&lt;/html&gt;");
      out.flush();
      out.close();
  }
  }
  </code></pre>