In the Java world, the two modern, main authn/authz frameworks are Spring Security [1] and Shiro [2]. Shiro is vastly easier to learn and apply.

Wicket [3] is a decent Java web framework that you can use together with Shiro; in the past there was a deeper integration [4]. Tapestry is another web framework that offers native integration [5].

[1] http://projects.spring.io/spring-security/

[2] http://shiro.apache.org/index.html

[3] http://wicket.apache.org/

[4] https://github.com/55minutes/fiftyfive-wicket

[5] https://tapestry.apache.org/security.html