server.xml
-------------------------

<?xml version="1.0" encoding="UTF-8"?>
<Server port="${shutdown.port}" shutdown="SHUTDOWN">

  <Listener className="org.apache.catalina.core.JasperListener"/>
  <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener"/>
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>

  <Listener accessFile="${catalina.base}/conf/jmxremote.access" authenticate="true" bind="127.0.0.1" className="com.springsource.tcserver.serviceability.rmi.JmxSocketListener" passwordFile="${catalina.base}/conf/jmxremote.password" port="${jmx.port}" useSSL="false"/>

  <Listener className="com.springsource.tcserver.serviceability.deploy.TcContainerDeployer"/>

  <GlobalNamingResources>
    <Resource auth="Container" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" name="UserDatabase" pathname="conf/tomcat-users.xml" type="org.apache.catalina.UserDatabase"/>
  </GlobalNamingResources>

  <Service name="Catalina">

    <Executor maxThreads="300" minSpareThreads="50" name="tomcatThreadPool" namePrefix="tomcat-http--"/>

    <Connector acceptCount="100" connectionTimeout="20000" executor="tomcatThreadPool" maxKeepAliveRequests="15" port="${http.port}" protocol="HTTP/1.1" redirectPort="8443"/>

    <Engine defaultHost="localhost" name="Catalina">

    <Realm className="org.apache.catalina.realm.MemoryRealm"></Realm>


      <Host appBase="webapps" autoDeploy="true" deployOnStartup="true" deployXML="true" name="localhost" unpackWARs="true" xmlNamespaceAware="false" xmlValidation="false">
      </Host>
    </Engine>
  </Service>
</Server>


tomcat-users.xml
-----------------------------------

<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
  <role rolename="test"/>
  <user username="user" password="pass" roles="test"/>
</tomcat-users>


web.xml (just the bottom of the file)
---------------------------------
    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
        <welcome-file>index.htm</welcome-file>
        <welcome-file>index.jsp</welcome-file>
    </welcome-file-list>
      <security-constraint>
    <web-resource-collection>
      <web-resource-name>
        web
      </web-resource-name>
      <!-- This would protect the entire site -->
      <url-pattern>/*</url-pattern>

    </web-resource-collection>
    <auth-constraint>
      <!-- Roles that have access -->
      <role-name> test </role-name>
    </auth-constraint>
  </security-constraint>

  <!-- BASIC authentication -->
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name> Example Basic Authentication </realm-name>
  </login-config>

  <!-- Define security roles -->
  <!-- <security-role>
    <description> Test role </description>
    <role-name> test </role-name>
  </security-role> -->

</web-app>