To change the login method to use browser-based authentication, simply modify the deployment descriptor, web.xml. Browser-based authentication is defined completely in the deployment descriptor and nowhere else.
The <login-config> XML tag is used to encapsulate a new authorization method (<auth-method>). There are three options for the <auth-method>:
BASIC, in which the Web browser displays a user name/password dialog box. This user name and password is authenticated against the realm.
FORM, which is the HTML form-based authentication used in the form-based example.
CLIENT-CERT, which requires SSL and a client-side certificate. This option is discussed ...