There are two primary java-based map servers; GeoServer and Deegree
1) Geoserver is easier to configure and install, has a more active development team and is built upon GeoTools ( the premier java GIS data abstraction library ). In general Geoserver (along with Geotools and UDIG) are at the forfront of java-based GIS software.
2) Deegree supports virtually all of the OGC standards (though WMS and WFS are all that we really need). It is the official reference implementation of the OGC WMS specification. It is needlessly complicated to install and configure when compared to geoserver. It does not build off of Geotools.
Neither of the java options supports raster data anywhere near as well as UMN Mapserver which is vastly superior in that department.
I would recomment geoserver based on ease of use and a better developement community (I may be biased since I know a few of the
of them personally). Thus all efforts for the forseeable future will be focussed on geoserver.
There are a few caveats with geoserver related to security; in fact a security model is vitually non-existent and there is no user or group level access control. We'll have to take extra care to make sure geoserver does not reveal any non-public data.. this may take some considerable hacking into the geoserver code base to do so since the geoserver team doesn't seem to worry about this too much.
An additional note about Geotools. This library provides the foundation for geoserver as well as other gis apps such as udig and can read/write most standard vector data formats. Thus it will provide the bridge between the metacat documents and their spatial data representation in pure java, which alone is worth going with the geotools/geoserver stack.