From: <glassfish_at_javadesktop.org>
Date: Thu, 28 Feb 2008 15:04:17 PST

I can think of one solution... Instead of using docroot, deploy an empty web application as "/". See this post for more details http://blogs.sun.com/alexismp/entry/glassfish_tip_have_your_application

After you this you can use the regular way of securing a portion of web app,
[Message sent by forum member 'rmsh' (rmsh)]

http://forums.java.net/jive/thread.jspa?messageID=261517