This distinction often causes much confusion. A role can also contain any number of users. Roles are an app server concept. We wish to authenticate users against these database tables. Roles in web.xml are local, in that they only apply to the web module.
Roles defined in application.xml are global in that they apply to the entire application.
The J2EE spec specifies also that exact same xml fragmet has to go into web.xml, to specify the roles available to the app. The description of the roles will be inherited from that specified in application.xml , but can be overridden within the module. Installing the User Manager First lets configure the user manager, this involves registering the DataSourceUserManager with the application, and passing various properties. The properties are used to connect to the database and to determine which tables and columns should be queries. Consult the javadocs for DataSourceUserManager for a detailed breakdown of these properties.