Description of problem: The realm may have already performed a mapping for the username so priority should be given to this. As an example if the realm has been configured to strip the realm name from the identity of a user authenticated using GSSAPI then by the time it reaches the EJB call the username should not contain the realm name.