Good Authentication and Authorisation Package in Java?

Question

I'm looking for an open source package written in java that implements a registration, authentication (like securityfilter) with captchas and email link verification and all that. I could write it, but why reinvent the wheel. I've looked all over the place and haven't found anything. Does such a thing exist?

Answer 1

In my experience nothing beats ACEGI (http://www.acegisecurity.org/) which was recently merged with Spring and renamed Spring Security.

Answer 2

ACEGI is good, but it is too coupled to the Spring Framework. An alternative, if you are not using Spring, is Apache Shiro which is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session management and cryptography.