Hello jules, I am unable to authenticate user for Servlets. Actually , I have a client.war directory in which I have 3 subdirectories as jsp(all the jsp files here), META-INF(application.xml here), WEB-INF(web.xml file and subdirectory \CLASSES\servlets\*.class), Now by specifying <url-pattern>/jsp<url-pattern> in web.xml, I am able to restrict the user access to jsps but how to restrict the user access to serveltes in \classes\servlets. \servlets is package mentioned in my servlet source files. I tried lot but I am unable to get the things working. Moreover whenever I am moving CLASSES directoy out of WEB-INF, server does not recognize the servlet class saying "No class found". So let me know if my directoy structure is alright or do I need to change it.