Is there a tomcat anonymous role or user for tomcat security realms?

I want a certain role to be protected with a username and password in some environments, but not require 开发者_运维问答even a prompt in others. If I have an auth-constraint in a tomcat web.xml, can I create a user with the role needed that has 'anonymous' access?

in your tomcat-users.xml file (%TOMCAT_HOME%/conf) add in your 'anonymous' role there. Then you can use the auth-constraint to secure your application.

your tomcat-users.xml will look something like this (this is v5.5)

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <role rolename="anonymous"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="role1" password="tomcat" roles="role1"/>
  <user username="myUser" password="myPassword" roles="anonymous"/>
</tomcat-users>

The user will then need to enter myUser/myPassword to access the application