Nabila Mohammad wrote:...Does that mean I have to configure/create a Realm to test any part of Security?
Yes, a Realm is where you store the user's login credentials (username/password/roles etc..). Easiest way would be to use a memory realm, edit the tomcat-users.xml (for Tomcat) as mentioned in the link provided by Ulf.