I see that in Jetspeed's demo portlets the web.xml defines the following tags security-constraint, login-config, and multiple security-role tags. The meaning of these are explained here.

security-constraint defines a list of web resources (urls) protected by web security and a list of roles authorized to access these resources.

login-config defines the authentication method and the realm name. Optionally a login page and a error page can be defined.

The security-role tag must appear if this is a custom role that does not already exist in the container.