web.xml

• Indicar las paginas que serán restringidas

• Agregar los roles

  <!--
JAVA EE 8 API SECURITY
    -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Application pages</web-resource-name>
            <url-pattern>/faces/pages/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>ADMINISTRADOR</role-name>
            <role-name>USER</role-name>
        </auth-constraint>
    </security-constraint>




    <security-role>
        <role-name>USER</role-name>
    </security-role>
    <security-role>
        <role-name>ADMINISTRADOR</role-name>
    </security-role>