protect endpoint with basic auth

[Matthew Broadhead]

my webapp already has a login-config set to keycloak in web.xml so AFAIK 
i cannot define any other security configs there.  why doesn't tomcat 
allow multiple security methods?
<login-config>
    <auth-method>KEYCLOAK</auth-method>
    <realm-name>secure</realm-name>
</login-config>
is there another way to protect a jax-rs endpoint using basic auth 
without having to create another webapp?  i read something about valves...