请问一个关于Weblogic安全认证问题？多谢！

[searchermail]

本人编写了一个利用weblogic中的安全认证来控制用户访问的例子，修改了如下配置文件：
web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>BasicAuthentication</display-name>
<description>Basic Authentication Sample for weblogic</description>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>myrealm</realm-name>
</login-config>
<security-role>
<role-name>webuser</role-name>
</security-role>
<security-constraint>
<web-resource-collection>
<web-resource-name>ResourceNameforAccess</web-resource-name>
<url-pattern>/index.jsp</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>webuser</role-name>
</auth-constraint>
</security-constraint>
</web-app>
=============================================================================
weblogic.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE weblogic-web-app PUBLIC "-//BEA Systems, Inc.//DTD Web Application 8.1//EN" "http://www.bea.com/servers/wls810/dtd/weblogic810-web-jar.dtd">
<weblogic-web-app>
<context-root>BasicAuthentication</context-root>
<security-role-assignment>
<role-name>webuser</role-name>
<principal-name>Administrators</principal-name>
<principal-name>MormalUser</principal-name>
</security-role-assignment>
</weblogic-web-app>
在Jbuilder X中编译时，报错如下：
"index.jsp": <2004-11-5 ÏÂÎç16ʱ39·Ö05Ãë GMT+08:00> <Warning> <HTTP> <BEA-101248> <[D:\*****\Programs\Java\BasicAuthentication\BasicAuthentication]: Deployment descriptor "web.xml" is malformed. Check against the DTD: org.xml.sax.SAXParseException: The content of element type "web-app" must match "(icon?,display-name?,description?,distributable?,context-param*,filter*,filter-mapping*,listener*,servlet*,servlet-mapping*,session-config?,mime-mapping*,welcome-file-list?,error-page*,taglib*,resource-env-ref*,resource-ref*,security-constraint*,login-config?,security-role*,env-entry*,ejb-ref*,ejb-local-ref*)". (line 27, column 11).>
weblogic错误类同上。但上面的配置是参照文档写的，而且和welogic的配置是没有问题的。故请相关经验的高人指教，万谢！

[trumplet]

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>BasicAuthentication</display-name>
<description>Basic Authentication Sample for weblogic</description>
<welcome-file-list>
<welcome-file>/index.jsp</welcome-file>
</welcome-file-list>
<security-constraint> <!-- 这段须在login-cinfig之前出现 -->
<web-resource-collection>
<web-resource-name>ResourceNameforAccess</web-resource-name>
<url-pattern>/index.jsp</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>webuser</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>myrealm</realm-name>
</login-config>
<security-role>
<role-name>webuser</role-name>
</security-role>
</web-app>

web-app.xml里边的元素要按照顺序http://java.sun.com/dtd/web-app_2_3.dtd定义的那样书写。

[trumplet]

另外， jbuilder 可以在 可视化界面 编辑修改 部署描述符 文件。