Index: lams_tool_laqa/web/WEB-INF/web.xml
===================================================================
diff -u -r0409f98dc17dfd380badf33ae103a47d0fffc4e5 -r0db83894504dc7652d3670a6ce496605b961faa1
--- lams_tool_laqa/web/WEB-INF/web.xml	(.../web.xml)	(revision 0409f98dc17dfd380badf33ae103a47d0fffc4e5)
+++ lams_tool_laqa/web/WEB-INF/web.xml	(.../web.xml)	(revision 0db83894504dc7652d3670a6ce496605b961faa1)
@@ -215,28 +215,129 @@
 		    <taglib-uri>tags-xml</taglib-uri>
 		    <taglib-location>/WEB-INF/jstl/tlds/x.tld</taglib-location>
 		  </taglib>
-		<!--  ======================================================== -->	
-		<!--  JSTL 1.2 Tag Library: Apache implementation of TLV	   -->
-		<!--  ======================================================== -->	
-		  <taglib>
-		    <taglib-uri>tags-permittedTaglibs</taglib-uri>
-		    <taglib-location>/WEB-INF/jstl/tlds/permittedTaglibs.tld</taglib-location>
-		  </taglib>
-		  <taglib>
-		    <taglib-uri>tags-scriptfree</taglib-uri>
-		    <taglib-location>/WEB-INF/jstl/tlds/scriptfree.tld</taglib-location>
-		  </taglib>
-		<!--  ======================================================== -->	
-		<!--   Customized Tag Library -->
-		<!--  ======================================================== -->	
-		<taglib>
-		    <taglib-uri>fck-editor</taglib-uri>
-		    <taglib-location>/WEB-INF/fckeditor/tlds/FCKeditor.tld</taglib-location>
-		</taglib>
-		 <taglib>
-		   <taglib-uri>tags-lams</taglib-uri>
-		   <taglib-location>/WEB-INF/lams.tld</taglib-location>
-		</taglib>
+			<!--  ======================================================== -->	
+			<!--   Customized Tag Library -->
+			<!--  ======================================================== -->	
+			<taglib>
+			    <taglib-uri>fck-editor</taglib-uri>
+			    <taglib-location>/WEB-INF/fckeditor/tlds/FCKeditor.tld</taglib-location>
+			</taglib>
+			<taglib>
+			   <taglib-uri>tags-lams</taglib-uri>
+			   <taglib-location>/WEB-INF/lams.tld</taglib-location>
+			</taglib>
 	</jsp-config>
 
+
+  	<!--  Security Constraint -->
+	<security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Secure Content</web-resource-name>
+			<url-pattern>/*</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>LEARNER</role-name>
+    		<role-name>TEACHER</role-name>
+    		<role-name>MONITOR</role-name>
+    		<role-name>AUTHOR</role-name>
+    		<role-name>ADMIN</role-name>
+    		<role-name>SYSADMIN</role-name>
+    	</auth-constraint>
+    </security-constraint>
+
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Authoring Update</web-resource-name>
+		    <url-pattern>/authoring.do</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>AUTHOR</role-name>
+    	</auth-constraint>
+    </security-constraint>
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Staff Content</web-resource-name>
+		    <url-pattern>/monitoring.do</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>MONITOR</role-name>
+    		<role-name>TEACHER</role-name>
+    	</auth-constraint>
+    </security-constraint>
+
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Adminstrator Content</web-resource-name>
+		    <url-pattern>/admin.do</url-pattern> 
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>ADMIN</role-name>
+    	</auth-constraint>
+    </security-constraint>
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>LAMS System Adminstrator Content</web-resource-name>
+		    <url-pattern>/sysadmin.do</url-pattern> 
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>SYSADMIN</role-name>
+    	</auth-constraint>
+    </security-constraint>
+	<!--  some combine role security setting -->
+    <security-constraint>
+	   	<web-resource-collection>
+	    	<web-resource-name>Download Files</web-resource-name>
+		    <url-pattern>/download/</url-pattern>
+    	</web-resource-collection>
+    	<auth-constraint>
+    		<role-name>AUTHOR</role-name>
+    		<role-name>MONITOR</role-name>
+    		<role-name>TEACHER</role-name>
+    		<role-name>ADMIN</role-name>
+    		<role-name>SYSADMIN</role-name>
+    	</auth-constraint>
+    </security-constraint>
+
+  <!-- ======================================================== -->
+	<!--  Security Roles -->
+    <!-- ======================================================== -->
+	<security-role>
+		<description>Student</description>
+		<role-name>LEARNER</role-name>
+	</security-role>
+	<security-role>
+		<description>Student</description>
+		<role-name>TEACHER</role-name>
+	</security-role>
+
+	<security-role>
+		<description>Can create/modify a learning design</description>
+		<role-name>AUTHOR</role-name>
+	</security-role>
+
+	<security-role>
+		<description>Can running and monitoring a learning session</description>
+		<role-name>MONITOR</role-name>
+	</security-role>
+
+	<security-role>
+		<description>Can add/remove users to the system, set up classes of users for sessions</description>
+		<role-name>ADMIN</role-name>
+	</security-role>
+
+	<security-role>
+		<description>Can add/remove users to the system, set up classes of users for sessions</description>
+		<role-name>SYSADMIN</role-name>
+	</security-role>
+	<!--  Login Configuration -->
+  	<login-config>
+   		<auth-method>FORM</auth-method>
+		<realm-name>LAMS</realm-name>
+   		<form-login-config>
+    		<form-login-page>/login.jsp</form-login-page>
+			<form-error-page>/login.jsp?failed=y</form-error-page>    		    		
+   		</form-login-config>
+   	</login-config>
+
+
 </web-app>