Triggered by this answer; quoting:
You are on the right track. Take a look at this article. There are many other articles on that topic I think, so choose one and try to understand it.
Another way I would recommend is integration of spring security with Struts 2. That way you get secured and proven configurable security stack.
It's not just a link, but it almost is, and includes a suggestion to do something other than what the OP is asking. The suggestion is valid, too, although it doesn't directly answer the question.
I'm trying to understand where the line is drawn, and this specific answer is giving me some problems. The OP's original question is too broad to be answered in a reasonable way. Chopping it down to its core makes it answerable without too much boilerplate.
Note: The original answer has since been expanded eliminating any doubt. But I appreciate everybody's input; it was all quite helpfule.