title: url-pattern for security-constraint not working
body: <p>I've defined two roles - user  </p>
  
  <pre><code>    &lt;security-role&gt;
       &lt;role-name&gt;User&lt;/role-name&gt;
      &lt;/security-role&gt;
  </code></pre>
  
  <p>and administrator </p>
  
  <pre><code>    &lt;security-role&gt;
        &lt;role-name&gt;Admin&lt;/role-name&gt;
      &lt;/security-role&gt;
  </code></pre>
  
  <p>in my web.xml. </p>
  
  <p>Problem 1 - </p>
  
  <p>I want the application to be accessed by users only if they have either of these two roles (there may be more roles added in the future, so I haven't used a * role pattern)</p>
  
  <pre><code>&lt;security-constraint id ="FullAccess"&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;CPDC Application&lt;/web-resource-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
        &lt;role-name&gt;Admin&lt;/role-name&gt;
        &lt;role-name&gt;User&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
    &lt;/security-constraint&gt;
  </code></pre>
  
  <p>This does not work if there are two roles in . Removing one of the roles causes it to work as expected. What if I want two roles to have access to this resource?</p>
  
  <p>Problem 2 -</p>
  
  <p>Now, I also want only users with the Admin role to be able to access all resources down from adminresource/</p>
  
  <pre><code> &lt;security-constraint id="AdminAccess"&gt;
    &lt;web-resource-collection&gt;
      &lt;web-resource-name&gt;Admin resources&lt;/web-resource-name&gt;
      &lt;url-pattern&gt;/appname/servlet.svc/adminresource/*&lt;/url-pattern&gt;  
    &lt;/web-resource-collection&gt;
    &lt;auth-constraint&gt;
       &lt;role-name&gt;Admin&lt;/role-name&gt;
    &lt;/auth-constraint&gt; 
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>This constraint does not work, and even someone with a User role is able to access urls of the form <a href="https://localhost:8080/appname/servlet.svc/adminresrouce/test" rel="nofollow noreferrer">https://localhost:8080/appname/servlet.svc/adminresrouce/test</a></p>
  
  <p>Could someone please help?</p>