Do I need to set security-constraint in web.xml

[blackcode82]

I am using Spring security with OpenSSO under Glassfish. Just wondering do I still need to specify security-constraint in web.xml? or it is not required?

<security-constraint>
<web-resource-collection>
<web-resource-name>secure</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>HEAD</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

[Rob Winch]

Adding these values uses container managed security which is different from Spring Security. In general, all your Spring Security configuration will be in your Spring ApplicationContext. I would recommend looking at the getting started page.