My evaluation of Jira is now complete and we have bought a copy for the project I am working on at the moment. It is a great issue tracker and has been very easy to integrate into our application. If you are involved in a commercial project that needs a strong issue tracking mechanism then for 1000USD it really isn't worth trying to write the functionality yourself.
It is easy to plug in your own authentication mechanisms (we had an existing EJB authenticator), but I do have one word of warning. Make sure that you take a look at the cookie handling that Seraph uses under the hood. You can easily replace the mechanisms that it uses, and you really should if the application you are using is at all sensitive.