Just a quick comment. For step 4 in the real world implementation, you usually don't want to put user credentials in property files, you will either need to use database login module or ldap login module.