"annaunivStud Sboa",
We don't have many rules here at the JavaRanch, but one we do insist on is that you use a Real Name, not a "handle" or alias. See this link:
http://www.javaranch.com/name.jsp for more information.
First, if you depending on an
IDE to do all your work, you'll never really understand what you're doing. There is plenty of documentation on how to set up and use standard (container-based) authentication, but most of it is on how to set up and use authentication, not on how to get RAD to do it for you.
For the short answer, however, the web.xml doesn't actually protect "pages", it protects URLs. You define URL
patterns in web.xml and assign them to security roles. The application container (server) then checks incoming URLs and determines if the user fits into one or more of the allowable roles. It also diverts the request to login, if the user isn't logged in yet.
Roles can also be tested on the JSF page itself and in
Java code. For information on how to do this, I recommend reading the Sun
JEE documentation.
