Hi all,
Thanks all of you who read and give answers to this thread. Finally, I change to use Tomcat JDBCRealm for authentication and authorization. It is quite simple and meet my requirement, which is form based and keeping the user name and encrypted password in the database.
Maybe in the future, another project will require Acegi and I will remember to expose login page to anonymous (not try if it works because of busy).
BTW, what are the advantages of using Acegi instead of Tomcat JDBCRealm except keeping the project independent from specific server?
Thanks,


).

