title: Authentication and Authorization Framework for Java Web-Application
body: <p>I am programming a Web-Application with Java EE, JSF and Hibernate. I do not use Spring or EJB! Now I am at the point where to implement authentication and authorization. I need to access an Active Directory or LDAP. And I want to implement my own roles, that are not retrieved from the AD/LDAP. </p>
  
  <p>My Question is:
  What's the easiest way to implement that? Should I use a framework like JAAS/Apache Shiro? And which one is best for my intetions?</p>
  
  <p>About the little role concept: I planned to set up a property-file, where I can configure the roles. I have only few roles, so a big concept is not that necessary?!</p>
  
  <p>I am very glad of any recommendation or suggestion.</p>