I have seen similar problems in apps that call Configuration.setConfiguration which replaces the JAAS config used by the appserver.
One easy way to see if this is happening (assuming you have not already granted the fedora app the corresponding permission) would be to turn on the glassfish security manager, and renable or deploy the fedora app. If it is replacing the jaas Config, you should see a
failed permission check of:
javax.security.auth.AuthPermission "setLoginConfiguration";
I am not sure what a JAAS filter is, but maybe it has a similar effect.
[Message sent by forum member 'monzillo' (ronald.monzillo_at_sun.com)]
http://forums.java.net/jive/thread.jspa?messageID=386424