Need a login strategy for JSF application

Question

I have inherited a JSF application (prototype) and need to modify this application to require a user login. Right now, the application requires a login only for a sub-portion of the application, well after JSF is up and running. That has to change to require the login before the JSF application is invoked.
Basically, what I want to do is present a standard login form (user name, password, and "submit" button). This information will be sent to "j_security_check" where the servlet engine will validate the user against an LDAP server and then look up some user role information. I have no control over user authentication. Once the user has logged in, the application will be looking at user roles to determine what elements of the JSF application they are permitted to access.
In addition, I need to be able to detect when the user's session has expired. When this occurs, I need to automatically reroute the user back to the login page. The prototype I inherited currently has all of the JSF backing beans check to see if the Session is still valid before executing any actions. This seems rather tedious and error-prone to me.
I am not very familiar with security and user authentication issues (somebody else always wrote that part). I think the approach I need to take is: (1) create a login page. (2) create a login error page. (3) create a filter to check to see if the user's session has expired and, if so, re-route the request to the login page.
My questions:
1. Is this the best approach? If not , what is a better approach?
2. Can I use JSF elements for the various login pages, or do I need to use JSP or HTML elements only?
3. Can you point me to an example or tutorial that explains what I need to do?
I've looked at a couple of servlet books, a JSF book, and Sun's online Java tutorials, but I don't see anything that looks quite like what I think I need to do here.
Once I get passed security handling, the rest of the application is all JSF and will be easy to build.
Thanks for your thoughts, comments, and assistance.

Answer 1

I have three macs and use one of them as the TM backup destination (that mac has 4 large external disks, I devote one disk at a TM backup for each of the macs) - that mac is also the file server. (I do also use an externally attached HD on one of the other macs as redundancy.) The system works very well and when set up requires no administration, it's automatic! Since the backups are made hourly, I have fresher data than my old system of doing nightly backups using a traditional backup app.
I even had to do a full restore last week on one of the macs and found the process worked flawlessly, had the mac up and running after the 2 hour restore finished.
For critical data (business or professional) I also recommend doing occasional boot disk backups using another backup app. I do that with one of my macs. Note: although I have wireless capability with each mac, I use wired Ethernet connections for speed and reliability.