sc1.getResourceCollections().add(wrc1);
wrc1.getUrlPatterns().add("/restricted/post-only/excluded/*");
wrc1.getUrlPatterns().add("/*");
// <auth-constraint />
AuthConstraintMetaData excluded = new AuthConstraintMetaData();
sc1.setAuthConstraint(excluded);
// user-data-constraint/transport-guarantee
UserDataConstraintMetaData none = new UserDataConstraintMetaData();
none.setTransportGuarantee(TransportGuaranteeType.NONE);
sc1.setUserDataConstraint(none);
securityContraints.add(sc1);
SecurityConstraintMetaData sc2 = new SecurityConstraintMetaData();
sc2.setDisplayName("SC2");
// web-resource-collection/web-resource-name = Restricted POST
WebResourceCollectionMetaData wrc2 = new WebResourceCollectionMetaData();
wrc2.setName("Restricted POST");
sc2.getResourceCollections().add(wrc2);
wrc2.getUrlPatterns().add("/restricted/post-only/*");
wrc2.getHttpMethods().add("POST");
AuthConstraintMetaData ac2 = new AuthConstraintMetaData();
ac2.getRoleNames().add("PostRole");
sc2.setAuthConstraint(ac2);
sc2.setUserDataConstraint(none);
securityContraints.add(sc2);
SecurityConstraintMetaData sc3 = new SecurityConstraintMetaData();