Java Web Authentication and Authorization

Question

Given these techonologies: Java, JAX-RS (either RESTEasy og Jersey), Javascript and jQuery. The servlet server is either Tomcat or Jetty. The GUI will be made as an "application" using jQuery and Javascript. MVC or MVP patterns will be used to separate view from model. The plan is to load the application after login. I need some recommendation on how to make a secure login and manage access (roles). So far I know about SSL, encryption, Security Annotations (to guard methods) - but still, I need some overview and tips. So far my plan is to start reading the Java SE documentation at:

http://www.oracle.com/technetwork/java/javase/tech/index-jsp-136007.html#overview

Some input would be appreciated.

Answer 1

Apache Shiro for JAAS - http://shiro.apache.org/

Answer 2

I'd recommend taking a look at the Spring Security library. It is highly customizable, documented well, and often used and discussed on the web. You may have heard of it before under its old name, Acegi.