Follow similar steps to those described in To Allow Access Manager Users to Access the Administration Web Application by editing the web.xml file of the host manager web application at the following location:
$CATALINA_HOME/server/webapps/host-manager/WEB-INF
All the remaining steps for configuring the host manager web application with declarative security are the same as for the administration web application.
Since both applications are accessible by users assigned to the role admin, the web.xml files for both applications must be edited in the same manner.