For business process flows, JBPM.
For database access (managing business data) EJB3 or Hibernate.
Authorization/security can be handled by JAAS. I guess if your protocol from the client/server is web services over HTTPS, you can use it.
Always build a small and simple app first, and work off other people's examples to begin with. Remember that somebody has probably already built the pieces for your application, you just need to find and steal them.
thank you for the response
i will certainly look into jBPM, as i hadn't heard of it (although it also is a JBoss product apparently)..
so i could use EJB3 or hibernate for database access, but do i also need a framework for the rest of the application? For example, can Spring be of any help here , or would session beans and message-driven beans from the EJB3 spec be more appropriate ?
would it be a good idea to start building a small CRUD application to manage a couple of what i call "helper objects" (like Country, Address, TaxCode, etc) and implement it using the different frameworks (thus making a spring-based one and making a ejb-based one in parallel)?
it seems a bit paradoxal to me that i understand a lot of the more complex features of J2EE like dependency injection, call interception, transactions, security, etc but i don't know where to begin to develop a small CRUD application, that basically just lets a client create some business objects and persist them :)