Latest revision:

Services framework: Spring framework (I'm only using the BeanFactory and ApplicationContext bits)
Portal: Gridsphere Portal
ORM: Hibernate

The result of the last week's coding has yielded:
Party management – CRUD parties, Contact information
Authentication – user accounts for logging in, proxied log-in mechanis,
Authorization – role-based access control
Persistence – stolen from Hibernate's CaveatEmptor project

Pretty much every service is managed by Spring, persistence by Hibernate.

The next step is to integrate what I've done with Gridsphere, in terms of user management. Also need to investigate Spring's portlet support.

The more I think about it, the more I'm convinced that portlets are the way to go in terms of developing web applications. Web applications need to stop thinking that they are alone in the world. They need to stop reinventing their own authentication and authorization mechanism.

So, develop your application in terms of JSR-168 compliant portlets and Spring services. Everything web-related goes to the portlet, everything else is either Pojos/DAOs or business objects.