Geronimo security question

[johnxmas]

Hi,

I'm moving applications from Tomcat to Geronimo 2.1.3

One of these apps had security constraints. I read the documentation but, 
honestly, I didn't understand how I can achieve the same under Geronimo

Any help would be appreciated

Jean-Noël

Here is the tomcat configuration

- tomcat-users.xml

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <role rolename="manager"/>
  <role rolename="admin"/>
  <role rolename="spadmin"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
  <user username="scort" password="scort" roles="manager,admin,spadmin"/>
</tomcat-users>

- the app web.xml had the following entries

   <security-constraint>
      <web-resource-collection>
         <web-resource-name>Protected Area</web-resource-name>
         <!-- Define the context-relative URL(s) to be protected -->
         <url-pattern>/main</url-pattern>
         <url-pattern>/jsp/customize.jsp</url-pattern>
         <url-pattern>/jsp/editconnspec.jsp</url-pattern>
         <url-pattern>/jsp/manageconnspec.jsp</url-pattern>
         <url-pattern>/admin/config/*</url-pattern>
         <url-pattern>/CreateConnection.srv</url-pattern>
         <url-pattern>/ModifyConnection.srv</url-pattern>
         <url-pattern>/EditConnection.srv</url-pattern>
         <url-pattern>/DeleteConnection.srv</url-pattern>
         <url-pattern>/ModifyRendering.srv</url-pattern>
         <!-- If you list http methods, only those methods are protected -->
         <http-method>GET</http-method>
         <http-method>DELETE</http-method>
         <http-method>POST</http-method>
             <http-method>PUT</http-method>
      </web-resource-collection>
      <auth-constraint>
         <role-name>spadmin</role-name>
      </auth-constraint>
    </security-constraint>

    <login-config>
      <auth-method>FORM</auth-method>
      <form-login-config>
        <form-login-page>/admin/login/login.jsp</form-login-page>
        <form-error-page>/admin/login/error.jsp</form-error-page>
      </form-login-config>
    </login-config>
    
    <security-role>
      <description>Security role for Smart Pack</description>
      <role-name>spadmin</role-name>
    </security-role>