use google, or read the specification.
servlet spec, if security  on servlets,
or ejb spec if secutiry on your beans.

As it seems implementing security  in JEE platform would be a tedious task.
but consider this:
1-if you want security at EJB level, learn how to integrate security with EJB
2-if you need security at servlet level, read your AppServer manual. but instead

I have uploaded some sections of certain books under "Security" folder
in files section of this group, hope you find them useful, there are
descriptions for declarative and progremmatic approaches to web
security

you may aslo look into java.sun.com and www.javaworld.com to find more
RI based samples and articles,

I have used JGuard in a sample  project and it worked fine. It has some sort of integeration with Struts too.
http://sourceforge.net/projects/jguard