Java Authentication and Authorization (JAAS) is your answer. Struts menu and its integration with JAAS may help you find a solution for your problem. There is very nice component on the shelf naming it ACGI Security which works fine with Spring framework and it is JAAS based but more high level than that.