To be honest I don't know too much about this topic either, so I can't really give you much technical help. However, here is a link to the relevant part of the JSP tutorial from the Sun site: http://java.sun.com/j2ee/1.4/docs/tutorial/doc/Security5.html
Also, you shouldn't need to store the usernames and passwords in an XML file. I'm not sure exactly how to work this; the tutorial page I linked to has many helpful links that can probably explain this better than I can.