How to integrate ModeShape JCR with Spring MVC security credentials?
Where does ModeShape store user data?
As described in the documentation, ModeShape has a pluggable authentication and authorization system. ModeShape has built-in support for JAAS and Servlet security, but it does not have support for Spring MVC out of the box. Adding custom implementations is pretty straightforward.