Question: I want to restrict access to certain URLs in my Tomcat webapp. 
Only 3 known IP addresses should be allowed access to URLs that fit a certain pattern.

e.g. `http://example.com:1234/abc/personId`

How can I achieve this?

Answer: 
Use org.apache.catalina.filters.RemoteAddrFilter and map it to the URL you wish to protect. See <http://tomcat.apache.org/tomcat-7.0-doc/config/filter.html#Remote_Address_Filter> for configuration details.
I wouldn't restrict access by IP address, for the following reasons:

* Doing so on say internal addresses, e.g. 10.0.0.0/24, means you implicitly trust this entire range. What happens if it is compromised?
* Not all of your customers can or will be able to get static IP addresses - assuming you might want to allow some customers access.
* Customers behind gateway devices where proxies do not support `x-forwarded-for` headers are going to just have the IP of the gateway device; trusting that IP trusts *everyone* behind the gateway, again assuming you might want to give some customers access.

Instead, if you need to run a system where some calls are only accessible to certain users, I'd use authentication - SSL client side certificates work quite well for this purpose. Alternatively, you could use something like [OAuth](http://oauth.net/).