Use OpenID if you can
This will provide you with a robust mechanism of authentication and you can implement your own internal authorization framework based on whatever you like.
A good solution (as you have identified) is to use Spring Security which comes with all the OpenID integration and method level authorization code out of the box. You might find it a bit overwhelming until you get used to how OpenID works, then it all fits together very well.
Alternatively, you can go for the lightweight approach and use the excellent openid4java library, and implement your own authorization scheme.
I recently wrote a demonstration of OpenID authentication, but it is based on Dropwizard which uses Jersey so is not within your requirements. However it might be helpful for you to see how it all fits together in an uncluttered environment.
Use OAuth2 for proxies
If your web service is expected to act as an authorised third-party to other web services (for example you're writing an app that posts to someone's Twitter account) then you'll need to get on board with OAuth2 instead. This can be quite tricky to get right since many service providers have their own flavours (Facebook, Twitter, Google etc) so you may have a lot more research to do.