The WSA's web.xml file can be set to tell the Java container that one or more of its URL paths require user authentication. When this is set, the Java container intercepts each HTTP request destined for that URL. For example, web.xml can be set so that users who try to access a WSA instance's Web service application URL are authenticated and required to have the role WsaWebServicesUser. In fact, this is how security can be initialized during OpenEdge installation.
Note: The entries in web.xml are case-sensitive.
For example, when the Java container intercepts an HTTP request destined for the WSA instance's Web service application URL:
1. The Java container performs HTTP Basic authentication using the user's ID and password.
2. If the user ID and password are valid, the Java container checks that the user ID has been granted access to the Role WsaWebServicesUser.
3. If the user ID has been granted access, the Java container passes the HTTP request and the authenticated user ID to the WSA.
