2．声明LDAP组为安全角色。

<web-app id="WebApp">
 <servlet id="bridge">
  <!-- ... -->
 </servlet>
 <!-- ... -->
 
 <security-role>
         <role-name>JazzAdmins</role-name>
         <role-name>JazzDWAdmins</role-name>
         <role-name>JazzUsers</role-name>
         <role-name>JazzGuests</role-name>

<!-- Addendum
 If the names of your LDAP Groups are the same as the default Jazz roles
 you don't need to add the following tags
-->
  <role-name>[LDAP Group for Jazz admins]</role-name>
  <role-name>[LDAP Group for Jazz users]</role-name>
  <role-name>[LDAP Group for Jazz Data Warehouse Admin]</role-name>
  <role-name>[LDAP Group for Jazz guest]</role-name>
<!-- End Addendum -->

 </security-role>
 <!-- ... -->
</web-app>

    3．添加组名称到一套安全角色，使得该组的用户被授予获得相匹配的网络资源。

<web-app id="WebApp">
 <!-- ... -->
 
 <security-constraint>
  <web-resource-collection>
   <web-resource-name>secure</web-resource-name>
   <url-pattern>/*</url-pattern>
  </web-resource-collection>
 
  <auth-constraint>
   <role-name>JazzUsers</role-name>
   <role-name>JazzAdmins</role-name>
   <role-name>JazzGuests</role-name>
   <role-name>JazzDWAdmins</role-name>

<!-- Addendum
 If the names of your LDAP Groups are the same as the default Jazz roles
 you don't need to add the following tags
-->
   <role-name>[LDAP Group for Jazz admins]</role-name>
   <role-name>[LDAP Group for Jazz users]</role-name>
   <role-name>[LDAP Group for Jazz Data Warehouse Admin]</role-name>
   <role-name>[LDAP Group for Jazz guest]</role-name>
<!-- End Addendum -->

  </auth-constraint>

  <user-data-constraint>
   <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
 </security-constraint>
 <!-- ... -->
</web-app>

    4．映射LDAP－JazzAdmins组和安全限制。

<web-app id="WebApp">
 <!-- ... -->
 <security-constraint>
  <web-resource-collection>
   <web-resource-name>adminsecure</web-resource-name>
   <url-pattern>/admin/cmd/*</url-pattern>
  </web-resource-collection>
 
  <auth-constraint>
   <role-name>JazzAdmins</role-name>

<!-- Addendum -->
   <role-name>[LDAP Group for Jazz admins]</role-name>
<!-- End Addendum -->

  </auth-constraint>
 
  <user-data-constraint>
   <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
 </security-constraint>
 <!-- ... -->
</web-app>

    完成修改server.xml和web.xml后，在Tomcat端的配置就完成了。