I am trying to build a simple application with logon function,

I know i can do it from servlet - session and using JAAS, I wonder their pros and cons, also it seems that if I use JAAS, my project cannot move to other application server easily, because all security roles need to setup again, am I right?

Also, does anyone have a simple login sample which use JAAS? thanks a lot~~~