There is no universal law, only best practice.
Don't use keys that change (business does) and if you can't find candidates, use surrogate keys. If you need composite keys for a unique natural key, consider a surrogate key instead. Beware: some natural keys look unique at first, but are not. This is where your DBA comes in, he should have the experience to find a good key for your data.
Hibernate works with surrogate, natural or composite keys just fine. I always use surrogate keys if I start with a new database. I don't see a reason to look for candidate keys first and I never had problems with surrogate keys. On the other hand, I got burned once with a natural key. Some people might argue that, if you can't find a natural unique key, your entity might miss some attributes. I can't see the point in this argument though.
A good summary:
http://www.bcarter.com/intsurr1.htm