Gil,
You can very probably use an implementation of jetty's LoginService class that references classes from inside your webapp. To do that, you'd need to put your LoginService impl onto the server's classpath, and make it delegate to another class that is inside your webapp; define an interface for the delegate that you implement inside your webapp. It won't work of course if you want to reference your webapp's classes inside the constructor of your LoginService, but if you can confine references to webapp classes to the authentication method calls you should be ok. You will also need to punch some holes in the serverClasses settings that are used to shield the webapp from access to jetty impl classes (see WebAppContext.prependServerClass() method).
You could also go the JAAS route, as I think (but haven't checked thoroughly) that the LoginContext will lazily delegate the loading of the LoginModule to the thread context classloader. Of course, if you want to use any of the jetty impl classes to help with your implementation, you're back to punching holes in the serverClasses settings again.
The login/auth services have traditionally been services that are offered by the container to the webapp, with the webapp simply using the javax.servlet api in conjunction with the declarative security statements in web.xml to ensure portability across containers. The login/auth info generally exists in the container's environment, with appropriate role mappings to the webapp's environment to support portability.
cheers,
Jan
