Using deployment descriptor authentication

Question

Hello,
I'm working on a web application and want to have a login for anyone that accesses the service. Is it possible to use the deployment descriptor to implement security but using my own authentication method? What I want to do is something like this; have my web.xml similar to this:
<security-constraint>
<web-resource-collection>
<web-resource-name>all private</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-page>/login.jsp</form-login-page>
</login-config>
But, in my login.jsp, instead of having <form action="j_security_check" ...
I'll do something like <form action="tryLogin" ... and I'll implement my own login method that will use HttpSession to validate/invalidate the session. The reason I'm trying to do things this way is that I want to have username/password pairs stored on mySQL on my server. I am using the struts framework and the latest version of Tomcat. If anyone knows if this would work or if there is an easier way to do this please let me know!! Thanks!

Answer 1

Yup. It can be done having "tryLogin" as a servlet/jsp which retrives the username and pwd from the request object and connects to db for validating the same