JdbRealm and BASIC http: Password successfully completed, web page displays 403

Question

I created a simple maven web project and will try to protect it with BASIC and jdbRealm authentication.

On my glassfish 4.0 server, I created a scope and enabled "Default Principal To Role Mapping". The security registration level is set to the best.

my web.xml looks like this:

    <?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>
    <security-constraint>
        <display-name>UserConstraint</display-name>
        <web-resource-collection>
            <web-resource-name>ApiResource</web-resource-name>
            <description/>
            <url-pattern>/*</url-pattern>
            <http-method>GET</http-method>
            <http-method>PUT</http-method>
            <http-method>HEAD</http-method>
            <http-method>POST</http-method>
            <http-method>OPTIONS</http-method>
            <http-method>TRACE</http-method>
            <http-method>DELETE</http-method>
        </web-resource-collection>
        <auth-constraint>
            <description/>
            <role-name>user</role-name>
        </auth-constraint>
    </security-constraint>
    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>jdbc-realm</realm-name>
    </login-config>
    <security-role>
        <description/>
        <role-name>user</role-name>
    </security-role>
</web-app>

It is believed that the spheres act. When I start the project, the authentication screen and login are displayed:

Glass fish yield:

    Fine:   [Web-Security] Setting Policy Context ID: old = null ctxID = security/security
Fine:   [Web-Security] hasUserDataPermission perm: ("javax.security.jacc.WebUserDataPermission" "" "GET")
Fine:   [Web-Security] hasUserDataPermission isGranted: true
Fine:   [Web-Security] Policy Context ID was: security/security
Fine:   [Web-Security] Codesource with Web URL: file:/security/security
Fine:   [Web-Security] Checking Web Permission with Principals : null
Fine:   [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest:   JACC Policy Provider: PolicyWrapper.implies, context (security/security)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/index.html" "GET"))
Fine:   [Web-Security] hasResource isGranted: false
Fine:   [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest:   Processing login with credentials of type: class com.sun.enterprise.security.auth.login.common.PasswordCredential
Fine:   Logging in user [joost] into realm: jdbc-realm using JAAS module: jdbcRealm
Fine:   Login module initialized: class com.sun.enterprise.security.ee.auth.login.JDBCLoginModule
Finest:   JDBC login succeeded for: joost groups:[users]
Fine:   JAAS login complete.
Fine:   JAAS authentication committed.
Fine:   Password login succeeded for : joost
Fine:   Set security context as user: joost
Fine:   [Web-Security] Policy Context ID was: security/security
Fine:   [Web-Security] Generating a protection domain for Permission check.
Fine:   [Web-Security] Checking with Principal : joost
Fine:   [Web-Security] Checking with Principal : users
Fine:   [Web-Security] Codesource with Web URL: file:/security/security
Fine:   [Web-Security] Checking Web Permission with Principals : joost, users
Fine:   [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest:   JACC Policy Provider: PolicyWrapper.implies, context (security/security)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/index.html" "GET"))
Fine:   [Web-Security] hasResource isGranted: false
Fine:   [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Fine:   [Web-Security] Policy Context ID was: security/security
Fine:   [Web-Security] hasUserDataPermission perm: ("javax.security.jacc.WebUserDataPermission" "" "GET")
Fine:   [Web-Security] hasUserDataPermission isGranted: true
Fine:   [Web-Security] Policy Context ID was: security/security
Fine:   [Web-Security] Codesource with Web URL: file:/security/security
Fine:   [Web-Security] Checking Web Permission with Principals : null
Fine:   [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest:   JACC Policy Provider: PolicyWrapper.implies, context (security/security)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/index.html" "GET"))
Fine:   [Web-Security] hasResource isGranted: false
Fine:   [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest:   Processing login with credentials of type: class com.sun.enterprise.security.auth.login.common.PasswordCredential
Fine:   Logging in user [joost] into realm: jdbc-realm using JAAS module: jdbcRealm
Fine:   Login module initialized: class com.sun.enterprise.security.ee.auth.login.JDBCLoginModule
Finest:   JDBC login succeeded for: joost groups:[users]
Fine:   JAAS login complete.
Fine:   JAAS authentication committed.
Fine:   Password login succeeded for : joost
Fine:   Set security context as user: joost
Fine:   [Web-Security] Policy Context ID was: security/security
Fine:   [Web-Security] Codesource with Web URL: file:/security/security
Fine:   [Web-Security] Checking Web Permission with Principals : joost, users
Fine:   [Web-Security] Web Permission = ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Finest:   JACC Policy Provider: PolicyWrapper.implies, context (security/security)- result was(false) permission (("javax.security.jacc.WebResourcePermission" "/index.html" "GET"))
Fine:   [Web-Security] hasResource isGranted: false
Fine:   [Web-Security] hasResource perm: ("javax.security.jacc.WebResourcePermission" "/index.html" "GET")
Fine:   FileRealm : file=C:\Users\Joost\School\S6\SOP\development_server\glassfish\domains\domain1\config\admin-keyfile
Fine:   FileRealm : jaas-context=ignore
Fine:   Login module initialized: class com.sun.enterprise.security.auth.login.FileLoginModule
Fine:   File login succeeded for: admin
Fine:   JAAS login complete.
Fine:   JAAS authentication committed.

However, the page displays an HTTP status of 403 - Forbidden. I have no idea. I also tried this with custom starring mappings, but that didn't work either.