I’m working on an implementation to secure JSF via Acegi for some time now. Although, I’ve no time left to develop a fully deployable example to present here, I will give you the most important information that helped me to get things running:
JSF/Acegi authentication with a backing bean
Martin helped me a lot and in the end his example got even better 
.
BTW: The JSF-Spring team has announced that they will support the use of the SpringMVC controller in the JSF lifecycle, so that the integration of Acegi will be easier. Maybe this will become a standard way of implementation. So, we can skip all the previous hacks.
I'm Rainer Eschen, an IT-Business Architect, who looks back on more than 20 years of programming experience. Since 1994 I'm an IT professional with a focus on consulting and architecture. I have also been part of "the source" for three years, working as Sun Sales Support Engineer and Sun Java Center Architect at Sun Microsystems, Germany.