title: Tomcat 7 - Multiple security-constraints not working
body: <p>Running Tomcat 7, I am trying to configure the /conf/web.xml on the Tomcat server to secure some URLs with basic authentication and to provide some other URLs for public access.</p>
  
  <p>The tomcat-users.xml contains following role and user:</p>
  
  <pre><code>&lt;role rolename="test-ui"/&gt;
  &lt;user username="paul" password="password" roles="test-ui"/&gt;
  </code></pre>
  
  <p>I have added the following section to Tomcats /conf/web.xml</p>
  
  <pre><code>&lt;security-constraint&gt;
     &lt;web-resource-collection&gt;
       &lt;web-resource-name&gt;Public access&lt;/web-resource-name&gt;
       &lt;url-pattern&gt;/docs/*&lt;/url-pattern&gt;
     &lt;/web-resource-collection&gt;
  &lt;/security-constraint&gt;
  
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Protected access&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;test-ui&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  &lt;security-role&gt;
      &lt;description&gt;Protected access&lt;/description&gt;
      &lt;role-name&gt;test-ui&lt;/role-name&gt;
  &lt;/security-role&gt;
  
  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
  &lt;/login-config&gt;
  </code></pre>
  
  <p>So there are two 'security-constraint' elements, the public one does not contain the 'auth-constraint', which actually should mean, there is no authentication necessary.</p>
  
  <p>When I open the URL
  <a href="http://localhost:8080" rel="nofollow">http://localhost:8080</a></p>
  
  <p>Tomcat asks for authentication.
  This is fine, however when I open the URL
  <a href="http://localhost:8080/docs/" rel="nofollow">http://localhost:8080/docs/</a></p>
  
  <p>Tomcat also asks for authentication and for my understanding this is configured as a "non secure" URL - so public acccess, but it does not behave like this.</p>
  
  <p>What did I wrong in the configuration or is this scenario not supposed to work like this?</p>
  
  <p>Thanks.
  Paul</p>