Hi all, I am trying to implement container managed security for my web application. In the web.xml, I am specifing the following section: <security-constraint> <web-resource-collection> <web-resource-name>A Resource</web-resource-name> <url-pattern>*.jsp</url-pattern> <http-method>GET</http-method> <http-method>POST</http-method> </web-resource-collection> <user-data-constraint> <transport-guarantee>NONE</transport-guarantee> </user-data-constraint> <auth-constraint> <role-name>users</role-name> </auth-contraint> </security-constraint> <security-role> <description>A role</description> <role-name>users</role-name> </security-role> <login-config> <auth-method>BASIC</auth-method> </login-config> I am just trying something simple here but when I deploy this, the server returns a 500 Internal Server Error. I have checked the logs but nothing is in the log to suggest the problem. If I comment out the <security-contraint></security-constraint> block, then the application works as suspected (although with container based authentiation. Does anyone have some ideas? Thanks so much... mark