<security-constraint>
    <web-resource-collection>
        <web-resource-name>Whole Application</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>

    <auth-constraint>   <!--Drop this element and no problem.-->
        <role-name>admin</role-name>
    </auth-constraint>

    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

<login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>Restricted Area</realm-name>
</login-config>

<role rolename="manager-gui"/>
<role rolename="admin"/>
<user username="myName" password="myPassw" roles="manager-gui,admin"/>