As it turned out, this one was rather easy to solve: Just overwrite AuthenticatingFilter#isAccessAllowed to make sure that the 'right' principal type is authenticated for your realm (the default implementation just uses Subject#isAuthenticated to test whether any principal is authenticated - no matter whether it fits the realm or not).