First, discuss IDE, ORM and security, and DB: In my opinion, IntelliJ IDEA is the best Java IDE. This is from the same people who developed Resharper for Visual Studio. It has the most powerful editor of all Java IDEs and has built-in support for many of the popular Java frameworks.
ORM: The most powerful ORM library in Java is Hibernate. Hibernate is an implementation of the Java Persistence API (JPA) standard. EclipseLink is another JPA implementation, but Hibernate is the best IMO option.
Security: Spring Security is perhaps the most powerful security infrastructure (authentication and authorization) available in the Java world.
DB: If you are comfortable working with SQL Server, continue to use this. However, do not use Microsoft JDBC drivers. Instead, use the DataDirect driver: http://web.datadirect.com/products/jdbc/index.html . If you do not want to use SQL Server, MySQL is an excellent choice for FOSS, and Oracle, DB2, etc. - these are other options.
There are several options for web infrastructure:
Option 1: if you need a RAD style frame, select Grails. Grails is similar to Ruby on Rails, but uses a JVM and Java-like, but dynamic language called Groovy. The ORM Grails API is called GORM, which is built on top of Hibernate, but is much easier to use. Grails also uses Spring Security to manage security.
Option 2: If you need enterprise-level infrastructure, select JBoss Seam + JavaServer Faces. JSF is a component-based MVC framework, and many great JSF libraries are available for use: RichFaces, OpenFaces, etc. Seam combines JSF with EJB, and together they create an excellent corporate infrastructure. However, it has a steep learning curve.
Option 3: use Spring + SpringMVC + JPA.
Option 4. Use Struts 2.
Concluding remarks. If you are looking for an easy-to-use MVC + ORM framework, use Struts 2 + JPA. If you are looking for RAD and the easy-to-use MVC + ORM framework, use Grails. If you are looking for a reliable and enterprise-oriented (but not easy to learn) structure, use JBoss Seam.