You'll have to set your web.xml security constraints login-config auth-method to FORM login:
<login-config>
<auth-method>FORM</auth-method>
<realm-name>You can but you are not forced to supply a realm here</realm-name>
<form-login-config>
<form-login-page>/login.xhtml</form-login-page>
<form-error-page>/access-forbidden.xhtml</form-error-page>
</form-login-config>
</login-config>
Secure your pages like this:
<security-constraint>
<web-resource-collection>
<url-pattern>/index.xhtml</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>Manager</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<role-name>Manager</role-name>
</security-role>