This guide shows how to configure a user/pass authentication for a specific webapp. How can I configure Tomcat to require a global user/pass for all the webapps?
Have not tried this, but you should be able to put the security constraints in the global web.xml, instead of the web.xml inside your webapp. Then, they will apply to all the webapps. The global web.xml is under (tomcat_root)/conf