WebSphere Express and Basic Authentication

(cross-posted to Ignite/400)

AGGGGGGGGGGGGGGGGGH!

I am now officially insane!  I just don't understand this...

Okay, on WAS35SE using IBM HTTP Classic, it was VERY easy to set up
authentication.  You set up your context for you web application in the
adminconsole, like so:

/psc400

Now, whenever you made a request to http://myas400/psc400/..., it would
be routed to WAS35SE.  However, there was no authentication.  If you
wanted to authenticate that, you simply added an authentication
directive to the HTTP configuration:

Protection PSC400 {           
      PasswdFile PSCSEC/PSC400
      ACLOverride Off      
      (...)   
      ServerID AUTHORIZED  
      UserID %%SERVER%%    
}                          
Protect /psc400/* PSC400

This would cause all access attempts to /psc400/* to first be
authenticated against the validation list named PSC400 in library
PSCSEC.

Very simple, very easy.  

Unfortunately, it doesn't seem quite that simple in WAS5X/Apacheh. Now,
the best reading I've been able to do as far as Apache and WAS5X is that
I may end up having to define security roles and mappings all at the web
application (WAR) level.  This seems an awfully complex way of doing
things.

Any insight from anyone?

Joe