Seraph is a very simple, pluggable J2EE web application security framework. It is developed and maintained primarily by Atlassian, who use it in their JIRA and Confluence products. It is licensed with a simple 'Open' licence from Atlassian.
Seraph is published in source form, and as an Apache Maven POM.