Question: I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application relatively more secured against potential threats. 

---

P.S. : I'm using JSF 2.0 as the front-end development framework in my web application.

Answer: 
Check out [OWASP](https://www.owasp.org/)'s [ESAPI (Enterprise Security API)](https://www.owasp.org/index.php/Esapi). 

> 
> ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The ESAPI libraries also serve as a solid foundation for new development. 
> 
> 
> 

While it is ported to several languages and frameworks, it started as a Java EE project. It's a very large and flexible framework, should meet most of your needs.

---

And as far as authentication and user management goes, *strongly* consider using OpenID (or something like that), so you dont have to manage it at all. Depending on your usecases and userbase, this can be a huge benefit, to you AND your users.
If you still have the freedom to choose the web application framework you are using, I can recommend web2py. It has built-in support for authentication, log-in management, and many other security needs. It was designed right from the get-go to make many security problems (e.g., XSS, SQL injection, session management attacks, etc.) nearly impossible. And, as a bonus, it is beautiful, clean, and easy-to-learn.

web2py: Give it a try.