Oh my god what I have done ! Sorry, there is no bug, just a programmer in a hurry who posts on the mailing-list without rtfm first =) It won't happen again... If anyone has questions about realms and authentication modules, I'm starting to be an expert. request.getRemoteUser() will send null if called by servlet or jsp outside the authentified realm...
