FORM Based Authentication - Without Container Template

1. Create a Dynamic Web Project with a web.xml file; name it as ServletSecurity.

2. Create a servlet RestrictedServlet with url pattern “/RestrictedServlet” that print “Restricted Servlet” to client.

3. Create a servlet LoginServlet with url pattern “/LoginServlet” that gets the username and password from client and validate it against a dummy hashmap of username and password.

4. Create a form in JSP/html file for authenticating users with FORM based authentication using custom fields for username and password and submit the form to LoginServlet. 

5. Create a JSP/html file to display in case of a login failure

6. Declare the type of authentication as FORM and specify the login form and error page in the web.xml.

7. Define roles, users and create mapping between them

8. Make entries in web.xml so that this security constraint is applied to any requests that come to the applicaiton, including to the servlet RestrictedServlet

9. Map roles with security constraints

10. Test login success and login failure scenarios

11. See the actual requests and responses between client and server using a protocol analyzer such as tcpmon or wireshark. 

FORM Based Authentication - With Container Template

1. Create a Dynamic Web Project with a web.xml file; name it as ServletSecurity.

2. Create a servlet RestrictedServlet with url pattern “/RestrictedServlet” that print “Restricted Servlet” to client.

3. Create a form in JSP/html file for authenticating users with FORM based authentication using the default template provided by container. 

4. Create a JSP/html file to display in case of a login failure

5. Declare the type of authentication as FORM and specify the login form and error page in the web.xml.

6. Define roles, users and create mapping between them

7. Make entries in web.xml so that this security constraint is applied to any requests that come to the applicaiton, including to the servlet RestrictedServlet

8. Map roles with security constraints

9. Test login success and login failure scenarios

10. See the actual requests and responses between client and server using a protocol analyzer such as tcpmon or wireshark.