Security Model or Architecture?

Are there any good examples of Security Models or Architectures? I am
a novice in web security models using Java/J2EE. If you recommend a
web site, book, articles, etc., I would appreciate it.

I am developing a few web applications using Java/Struts/WebSphere
4.x/5.x. Usually my model is very simple. When user logins into the
web application, the application checks against a USER and/or ROLES
table. Then the app populates a User object and places it into the
HttpSession.

Thanks!