Basic authentication on standalone OC4J 9.0.4

Question

I am trying to configure basic authentication on standalone OC4J 9.0.4 (Jdev 10g) but nothing happens, I am still able to get to the page. My deployment descriptor files:
* principals.xml
<principals>
     <groups>
          <groups>
               <description>AQ Demo Group</description>
               <group name="aqgroup" />
          </groups>
     </groups>
     <users>
          <user username="foo" password="bar">
               <description>no description</description>
               <group-membership group="aqgroup" />
          </user>
     </users>
</principals>
* web.xml
<security-constraint>
          <display-name>AQDemo Security Constraint</display-name>
          <web-resource-collection>
          <web-resource-name>MySecureArea</web-resource-name>
          <url-pattern>*</url-pattern>
          </web-resource-collection>
          <auth-constraint>
          <role-name>role1</role-name>
          </auth-constraint>
     </security-constraint>
     <login-config>
          <auth-method>BASIC</auth-method>
     </login-config>
     <security-role>
          <role-name>role1</role-name>
     </security-role>
* orion-application.xml
<?xml version = '1.0' encoding = 'windows-1250'?>
<!DOCTYPE orion-application PUBLIC "-//Evermind//DTD J2EE Application runtime 1.2//EN" "http://xmlns.oracle.com/ias/dtds/orion-application.dtd">
<orion-application>
<data-sources path="./data-sources.xml"/>
<security-role-mapping name="role1">
     <group name="aqgroup" />
</security-role-mapping>
</orion-application>
* application.xml
<?xml version = '1.0' encoding = 'windows-1250'?>
<!DOCTYPE application PUBLIC "-//Sun Microsystems, Inc.//DTD J2EE Application 1.3//EN" "http://java.sun.com/dtd/application_1_3.dtd">
<application>
<display-name>aqdemo</display-name>
<module>
<web>
<web-uri>aqdemo.war</web-uri>
<context-root>aqdemoroot</context-root>
</web>
<security-role-mapping name="role1">
     <group name="aqgroup" />
</security-role-mapping>
</module>
</application>

Answer 1

I commented out the jazn element now and I am prompted for username and password, so that part works. However, it's still not recognizing my user and I am only able to get “Not authorized” message. I'm guessing it has something to do with the security role mapping. This is how my files look now:
* principals.xml
<?xml version="1.0"?>
<!DOCTYPE principals PUBLIC "//ORACLE//DTD OC4J Principals 9.04//EN" "http://xmlns.oracle.com/ias/dtds/principals-9_04.dtd">
<principals>
     <groups>
          <group name="administrators">
               <description>administrators</description>
               <permission name="administration" />
          </group>
          <group name="aqgroup">
               <description>AQ Demo Group</description>
          </group>
          <group name="guests">
               <description>guests</description>
          </group>
          <group name="users">
               <description>users</description>
          </group>
     </groups>
     <users>
          <user username="jasmina" password="babu">
               <description>no description</description>
               <group-membership group="aqgroup" />
          </user>
          <user username="user" password="456" deactivated="true">
               <description>The default user</description>
               <group-membership group="guests" />
               <group-membership group="users" />
          </user>
          <user username="pwForSSL" password="123456" deactivated="true">
               <description>Password for database user Scott</description>
          </user>
          <user username="SCOTT" password="TIGER">
               <description>no description</description>
               <group-membership group="users" />
          </user>
          <user username="foo" password="bar">
               <description>no description</description>
               <group-membership group="aqgroup" />
          </user>
          <user username="pwForScott" password="TIGER" deactivated="true">
               <description>Password for database user Scott</description>
          </user>
          <user username="anonymous" password="">
               <description>The default guest/anonyomous user</description>
               <group-membership group="guests" />
          </user>
          <user username="admin" password="admin">
               <description>The default administrator</description>
               <group-membership group="administrators" />
               <group-membership group="guests" />
               <group-membership group="users" />
          </user>
          <user username="pwForSystem" password="manager" deactivated="true">
               <description>Password for database user Scott</description>
          </user>
     </users>
</principals>
* web.xml
<web-app>
<security-constraint>
<display-name>AQDemo Security Constraint</display-name>
<web-resource-collection>
<web-resource-name>MySecureArea</web-resource-name>
<url-pattern>*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>role1</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
<security-role>
<role-name>role1</role-name>
</security-role>
</web-app>
* orion-application.xml
<orion-application>
<data-sources path="./data-sources.xml"/>
<security-role-mapping name="role1">
<group name="aqgroup"/>
</security-role-mapping>
</orion-application>
* application.xml (location: OC4JHOME/applications/myapp/META-INF/)
<application>
<display-name>aqdemo</display-name>
<module>
<principals location="./principals.xml"/>
<web>
<web-uri>aqdemo.war</web-uri>
<context-root>aqdemoroot</context-root>
</web>
</module>
</application>