For now we use Tomcat Fome based authentication.
This creates several problems and limitations :
 - the system is not easily pluggable
 - we can't used Fome based auth and Basic auth at the same time without deploying a new Valve in tomcat (tested successfully)
 - this introduice a JBoss depency in our login system