Java options for web user authentication

Question

I'm looking for a secure user login/session management component for a public web app. Spring Security seems to have potential, are there any other high quality alternatives?

Conceptually this is easy and we currently have code that works fine, but I'd rather be using code that has been publicly reviewed for security flaws.

Needs:

• Login
• Logout
• Secure session token management (token not guessable)
• Session expiration
• Java/Tomcat support

Answer 1

Apache Shiro, formerly known as Ki and JSecurity before that, "is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session management and cryptography." It's been around for a while (first public release on 04/18/2006) and is currently in the Apache incubator. Just thought I'd mention it as an alternative to Spring Security (though I prefer Spring Security myself).