How can access control be implemented in Tomcat?

In Tomcat, access control can be implemented by configuring the web.xml file and using the and elements provided by Tomcat.

1. Configuration file for web applications
2. The XML file used in web development, named web.xml

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>
        <url-pattern>/protected/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

1. Sign in configuration
2. Configuring file for a web application.

<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>Protected Area</realm-name>
</login-config>

1. The XML file for users in Tomcat is called tomcat-users.xml.

<tomcat-users>
    <role rolename="admin"/>
    <user username="admin" password="admin" roles="admin"/>
</tomcat-users>

After configuring the above steps, when accessing the /protected/* path, users will be required to enter a username and password and must have the admin role to access it.