I am having a hard time understanding JAAS. It all seems more complicated than it should be (especially the Sun tutorials). I need a simple tutorial or example on how to implement security (authentication + authorization) in java application based on Struts + Spring + Hibernate with custom user repository. Can be implemented using ACEGI.
Other users have provide some very useful links above so I am not going to bother with links. I have done a similar research in JAAS for web application and has ran into a "mind roadblock" until I finally realize JAAS is a framework tackling security at a different "layer" then web applications in the Java World. It is build to tackle security issues in Java SE not Java EE.
JAAS is a security framework built for securing things at a much lower level then web-application. Some example of these things are code and resources available at the JVM level, hence all these ability to set policy files in the JVM level.
However, since Java EE is built on top of Java SE, a few modules from JAAS were reused in Java EE security such as the LoginModules and Callbacks.
Note that in addition to Java EE security, there is also Spring security (formerly known as Acegi), which similar to native Java EE security tackles a much higher "layer" in the securing web-application problem. It is a separate security implementation and is not built on top of standard Java EE security, although it behaves similarly in many regards.
To summarize, unless you are looking to secure resources in the Java SE level (classes, System resources), I don't see any real use of JAAS other than the using the common class and interfaces. Just focus on using Spring Security or plain old Java EE security which both solve a lot of common web application security problems.
Here are some of the links I used to help understand JAAS:
http://www.owasp.org/index.php/JAAS_Tomcat_Login_Module
http://www.javaworld.com/jw-09-2002/jw-0913-jaas.html
http://jaasbook.wordpress.com/
Also have a look at the Apache tomcat realms configuration how-to:
lsiu's answer is one the few answers here that really "get it" ;)
Adding to that answer, a really good reference on this topic is Whatever Happened to JAAS?.
It explains how JASPIC is the link in Java EE between the Servlet and EJB security models and potentially a JAAS login module, but that in many cases JAAS' role is reduced to that of a relatively simple username and roles provider in Java EE.
From the same author is JAAS in the Enterprise, which is an older article but provides a lot of historical background on why the Java SE (JAAS) and Java EE models diverged the way they did.
Overall but a few types from JAAS are directly used in Java EE, basically Principal , Subject, and CallbackHandler. The latter two are mainly used by JASPIC. I've explained JASPIC in the article Implementing container authentication in Java EE with JASPIC.
I can't speak too much to JAAS itself, but this "suggested steps" guide on Spring Security and the reference manual are both pretty good resources on Spring Security - if your setup is anything close to simple, you don't really need to do much more than read these.