> Markdown version of [Container-Managed Authentication](https://vaadin.com/docs/next/flow/security/plain-servlet/container-authentication). Section index: [llms.txt](https://vaadin.com/docs/next/flow/llms.txt)

# Container-Managed Authentication

Instead of checking the credentials against its own user store, as in [Setting Up Security](https://vaadin.com/docs/next/flow/security/plain-servlet/setup.md), an application can let the servlet container authenticate its users. The container checks the credentials against a *security realm*, which is a repository of users, their passwords, and their roles, and sets the user on the request itself.

`HttpServletRequest.login()` logs a user in through the realm. Replace `authenticate()` of the `SecurityUtils` class in [Setting Up Security](https://vaadin.com/docs/next/flow/security/plain-servlet/setup.md#authenticating-users) with the following, and leave out the filter:

```java
public static boolean authenticate(String username, String password) {
    HttpServletRequest request = VaadinServletRequest.getCurrent()
            .getHttpServletRequest();
    try {
        request.login(username, password);
        request.changeSessionId(); // Protects against session fixation.
        return true;
    } catch (ServletException e) {
        return false; // The credentials don't match.
    }
}
```

Role names in `@RolesAllowed` are passed unchanged to `isUserInRole()`, so they have to match the role names of the realm exactly.

How to configure a realm depends on the servlet container. Some containers also require an authentication method, configured with `<login-config>` in `web.xml`, before `login()` can be used. See the documentation of your container. The following examples use realms that read the users from a file, which is convenient for development. Both containers also provide realms that read the users from a database.

## <a id="tomcat"></a>Tomcat

Tomcat’s `UserDatabaseRealm` reads the users from `conf/tomcat-users.xml`:

`$CATALINA_HOME/conf/tomcat-users.xml`

```xml
<tomcat-users>
  <role rolename="admin" />
  <role rolename="user" />
  <user username="test" password="password1" roles="user" />
  <user username="admin" password="password2" roles="user,admin" />
</tomcat-users>
```

To read the users from a database instead, use `DataSourceRealm`. See [Realm Configuration](https://tomcat.apache.org/tomcat-11.0-doc/realm-howto.html) in the Tomcat documentation.

## <a id="jetty"></a>Jetty

Jetty’s `HashLoginService` reads the users, their passwords, and their roles from a properties file:

`realm.properties`

```properties
test: password1,user
admin: password2,user,admin
```

Register the login service for the web application — for example, in a context XML file in the `webapps` directory of `$JETTY_BASE` — and point it to the properties file, as described in the [Jetty documentation](https://jetty.org/docs/index.html). To read the users from a database instead, use `JDBCLoginService`. In Jetty 12.1, which supports Jakarta EE 11, the web application classes are in an environment-specific package, such as `org.eclipse.jetty.ee11.webapp`.

`A0A3832E-663B-47A6-B108-78F36B608B77`