Most application servers support JAAS. If your App server supports JAAS, then you can use simple container based authentication (basic, form-based etc.) and you can access the JAAS subject to get the user information. To authorize, you have to define your own rules and enforce them based on your needs, or use the simple Role-based authorization model.
If you do not have a supporting App Server, then you may have to write your own login modules and modify the login configuration for authentication. And then modify the policy file to enforce authorization. This article gives you an example for doing so: http://bdn.borland.com/article/borcon/files/3184/paper/3184.html