DataSourceSecurityFilter#selectUserPass=SELECT LOWER(username), id, countyid, seclevel FROM Users WHERE LOWER(username)=? AND PASSWORD=?

Long countyID = (Long) ClientSession.get().getSharedVariableMap().get("countyid");
Integer secLevel = (Integer) ClientSession.get().getSharedVariableMap().get("seclevel");
Long userId = (Long) ClientSession.get().getSharedVariableMap().get("id");

protected int negotiate(HttpServletRequest req, HttpServletResponse resp, final PrincipalHolder holder) throws IOException, ServletException {
  //Fill your principal and add it to the holder
  return STATUS_CONTINUE_WITH_PRINCIPAL;
 }

public class MyPrincipal extends SimplePrincipal {
    
    private AuthenticationBean autheticationBean;

    public MyPrincipal(String name) {
        super(name);
    }

    public MyPrincipal(AuthenticationBean bean) {
        super(bean.getUserName());
        this.autheticationBean = bean;
    }

    public AuthenticationBean getAutheticationBean() {
        return autheticationBean;
    }

    public void setAutheticationBean(AuthenticationBean autheticationBean) {
        this.autheticationBean = autheticationBean;
    }

}

Subject.getSubject(AccessController.getContext()).getPrincipals();

public class MyServletFilter extends AbstractChainableSecurityFilter{
  
 (...) //fields and some methods to check timestamp, translate internal state
    protected enum AuthenticationState {
        USER_AUTHENTICATED, ACCESS_DENIED, SERVER_ERROR
    }
    @Override
    protected int negotiate(HttpServletRequest req, HttpServletResponse resp, final PrincipalHolder holder) throws IOException, ServletException {
        final String token = req.getParameter(TOKEN_STRING);
        AuthenticationState result = authenticate(holder, token);
        return getFinalResult(result, req, resp); //translation from internal states to integer as expected by API
    }

    private AuthenticationState authenticate(final PrincipalHolder holder, final String token) {
        if (token == null) {
            return AuthenticationState.ACCESS_DENIED;
        } else {
            return authenticateUsingToken(token, holder);
        }
    }

    private AuthenticationState authenticateUsingToken(String token, PrincipalHolder holder) {
        AuthenticationBean bean;
        try {
            bean = extractAuthenticationBean(token);
        } catch (MyException e) {
            return AuthenticationState.SERVER_ERROR;
        }
        if (checkTimestamp(bean)) {
            // Get username and create principal
            if (!StringUtility.isEmpty(bean.getUserName())) {
                holder.setPrincipal(new MyPrincipal(bean));
                return AuthenticationState.USER_AUTHENTICATED;
            }
        }
        return AuthenticationState.ACCESS_DENIED;
    }
}

    <extension point="org.eclipse.equinox.http.registry.filters">
      <filter alias="/app" class="package.MyServletFilter">
            <init-param name="filter-priority" value="100" />
        </filter>

package.MyServletFilter#realm=REALM
package.MyServletFilter#active=true