Tomcat has both Authentication and Authorization.

It can have many different back-end systems:

• Simple XML file containing the user/passwords & roles.

• JNDI/LDAP

• Relational Databases

The "role" allows simple authorization-to-user assocations.