To define the authentication mechanism and constraints, update the security configuration defined in the web.xml file inside the web archive on the Corticon Server. For example, on Tomcat this file is located at <tomcat-dir>\webapps\axis\WEB-INF\web.xml. For other supported application servers, such as JBoss and WebSphere, see that server's documentation for the file's location and security configuration.

Corticon Server enables HTTP Basic Authentication by default. The web.xml file contains the following active security configuration, which requires an authenticated user that is assigned the ROLE_CorticonAdmin role. 

<security-constraint>
                <web-resource-collection>
                <web-resource-name>All Corticon SOAP Servlet Access</web-resource-name>
                <url-pattern>/*</url-pattern>
                </web-resource-collection>
                <auth-constraint>
                <role-name>ROLE_CorticonAdmin</role-name>
                </auth-constraint>
                </security-constraint>
                
                <login-config>
                <auth-method>BASIC</auth-method>
                <realm-name>Corticon Server Realm</realm-name>
                </login-config>
                
                <security-role>
                <role-name>ROLE_CorticonAdmin</role-name>
                </security-role>
Note: You can modify this configuration to integrate Corticon Server with your organization's enterprise authentication system. If you customize web.xml, ensure that access to the server remains protected, and that the appropriate Corticon roles are mapped to authenticated users or groups.

Corticon Server also includes an authentication filter that is enabled by default. 

<filter>
                <filter-name>CcSecurityFilter</filter-name>
                <filter-class>com.corticon.security.CcSecurityFilter</filter-class>
                </filter>
                
                <filter-mapping>
                <filter-name>CcSecurityFilter</filter-name>
                <url-pattern>/*</url-pattern>
                </filter-mapping>

For the default Basic Authentication configuration, keep this filter enabled.

With the above configuration, every time a user tries to access the server through a URL, a valid username/password must be supplied and verified. You need to decide whether to restrict defined user roles to specified URLs – the endpoints that perform specific actions. That is described in the next topic.

Users and roles for Apache Tomcat are defined in the tomcat-users.xml file (in a default installation its location is [CORTICON_HOME]\Server\tomcat\conf\tomcat-users.xml). A default Tomcat installation does not include a Corticon Server user or the ROLE_CorticonAdmin role. Add the required role, and then create a user that is assigned to that role:

<role rolename="ROLE_CorticonAdmin" />
                
                <user username="corticonuser" password="<strong-password>" roles="ROLE_CorticonAdmin" />

Replace the example username and password with credentials that are appropriate for your environment. Use a strong password and follow your organization's credential-management requirements.