client-server security questions

[Matrium]

Hi, i am not sure if this is really the correct place for my question, but i will try anyway :-)

I am using spring security in web application (atm with JSF2) and think its just so brillant, in many ways! But i really don't know anything compareable for desktop applications.

So my question is: How do you secure your (desktop-) richclient / server applications, which frameworks do you recommend? I have already written a login-module which uses kerberos for authentication, transfering the (kerberos-encrypted) ticket via a simple socket-stream to my server. But then i am just stuck. I just have no idea how ich should store users in general, how to manage active users and how to allow access e.g with RMI or how to secure this invocations. Kind of hard to explain.. Can you bring light in this darkness?