Jaas + tomcat 6

package javacenter.jaas;

import java.security.Principal;
import java.util.Set;

public class User implements Principal{
    private String name;  
    private Set roles;  
      
    public User(){  
          
    }  
    public User(String name){  
        this.name = name;  
    }  
      
    public String getName() {  
        return name;  
    }  
      
    public Set getRoles() {  
        return roles;  
    }  
  
    public void setRoles(Set roles) {  
        if (this.roles == null)  
            this.roles = roles;  
    }

}

package javacenter.jaas;

import java.security.Principal;

public class Role implements Principal{
	private String name;

	
	
	public Role(String name) {
		super();
		this.name = name;
	}

	public String getName() {
		return name;
	}

	public void setName(String name) {
		this.name = name;
	}

	@Override
	public int hashCode() {
		final int prime = 31;
		int result = 1;
		result = prime * result + ((name == null) ? 0 : name.hashCode());
		return result;
	}

	@Override
	public boolean equals(Object obj) {
		if (this == obj)
			return true;
		if (obj == null)
			return false;
		if (getClass() != obj.getClass())
			return false;
		Role other = (Role) obj;
		if (name == null) {
			if (other.name != null)
				return false;
		} else if (!name.equals(other.name))
			return false;
		return true;
	}
	
}

public boolean commit() throws LoginException {
		if (user != null && !subject.getPrincipals().contains(user)) {
			subject.getPrincipals().add(user);
		}
		if (roles != null) {
			for (Iterator it = roles.iterator(); it.hasNext();) {
				Role role = (Role) new Role((String) it.next());
				if (!subject.getPrincipals().contains(role)) {
					subject.getPrincipals().add(role);
				}
			}

		}
		return true;
	}
	public boolean login() throws LoginException {
		Callback callbacks[] = new Callback[2];
		callbacks[0] = new NameCallback("Login");
		callbacks[1] = new PasswordCallback("Senha", false);
		try {
			callbackHandler.handle(callbacks);
		} catch (IOException e) {
			e.printStackTrace();
		} catch (UnsupportedCallbackException e) {
			e.printStackTrace();
		}
		String login = ((NameCallback) callbacks[0]).getName();
		String senhaInformado = new String(((PasswordCallback) callbacks[1])
				.getPassword());
		System.out.println((new StringBuilder("LOGIN : ")).append(login)
				.toString());
		System.out.println((new StringBuilder("SENHA_INFORMADA : ")).append(
				senhaInformado).toString());
		if ("marcelo".equalsIgnoreCase(login)) {
			this.roles.add("Administrador Geral");
			this.roles.add("autenticado");
			this.roles.add("Consultor");
		}
		user = new User(login);
		user.setRoles(roles);
		this.sharedState.put("javax.security.auth.principal", user);
		this.sharedState.put("javax.security.auth.roles", roles);
		return true;
	}

<security-constraint>
		<web-resource-collection>
			<url-pattern>/*</url-pattern>
			<http-method>GET</http-method>
			<http-method>POST</http-method>
		</web-resource-collection>
		<auth-constraint>
			<role-name>autenticado</role-name>
		</auth-constraint>
	</security-constraint>
	<login-config>
		<auth-method>FORM</auth-method>
		<form-login-config>
			<form-login-page>/jsp/pages/login/form.jsp</form-login-page>
			<form-error-page>/jsp/pages/login/erro.jsp</form-error-page>
		</form-login-config>
	</login-config>
	<security-role>
		<role-name>autenticado</role-name>
	</security-role>

javacenter {
     javacenter.jaas.LoginModuleImpl debug=true required
         dataSourceName="Marcelo DataSource"
         sqlUser="Query qualquer"
         sqlRoles="Roles query"
    ;
};

<Realm className="org.apache.catalina.realm.JAASRealm"                 
               appName="javacenter"       
               userClassNames="javacenter.jaas.Role"       
               roleClassNames="javacenter.jaas.User"/>