Here is the article J2EE Application Security: Container vs. application-managed security, published in Java Developers Journal Journal.
