From: <glassfish_at_javadesktop.org>
Date: Tue, 16 Sep 2008 13:05:13 PDT
I agree with the recommendations in this post; in that it would probably be simplest to decompose your app into two war's.
that said, it is "possible" to do what you want, if you are willing to define you own Server Auth Module to implement your own variant of form-based login. writing a SAM is not trivial, but if you want to follow that path, you can see an intro to the process at: