I should be able to use role-name * to indicate no SAF permission required. This would only enforce if the userid/password are valid.
However, this does not seem to work:

<security-role>
<role-name>*</role-name>
</security-role>

<!-- CheckLogin request must be basic authorized -->
<security-constraint>
<web-resource-collection>
<web-resource-name>CheckLogin</web-resource-name>
<url-pattern>/checkLogin</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>