Correcting security settings

The application uses container-managed security exclusively. All security bindings are located in /web/WEB-INF/web.xml and /web/WEB-INF/sun-web.xml files. In the web.xml file, it is in the security-constraint and the security-role elements. By default the application accepts users with the staff role. If you need more roles, add more security-role elements and list them within auth-constraint.

The authentication realm used is file, and you can add another realm by editing the realm-name element. For GlassFish, the security roles defined in web.xml need to be mapped to user groups, which is done in the sun-web.xml file in the security-role-mapping element.