A couple of ideas
(1) If you can modify the web.xml of your webapps, just put in a few lines into the web.xml to require basic authentication. The trick is to make sure that the user has been designated a role in the tomcat-users.xml that matches the role defined in the auth-constraint section of the web.xml:
<user name="theuser" password="pas" roles="protected" />
(2) If your Tomcat server has an APache httpd server in front of it, it's pretty easy to do this in Apache. In your configuration file, you'll just need to set up something like this:
AuthName "Protected site"
Require user theuser