Wildfly 10 Windows authentication
<p>I got stuck on servlet's and security filter for a java web application.
so I got my web.xml which looks like this:</p>

<pre><code>&lt;!-- &lt;distributable/&gt; --&gt;

&lt;filter&gt;
&lt;filter-name&gt;com.company.xxx.xxx.xxx.SecurityFilter&lt;/filter-name&gt;
&lt;filter-class&gt;com.company.xxx.xxx.xxx.SecurityFilter&lt;/filter-class&gt;
&lt;/filter&gt;

&lt;filter&gt;
&lt;filter-name&gt;WaffleSSOFilter&lt;/filter-name&gt;
&lt;filter-class&gt;waffle.servlet.NegotiateSecurityFilter&lt;/filter-class&gt;
&lt;init-param&gt;
  &lt;param-name&gt;securityFilterProviders&lt;/param-name&gt;
  &lt;param-value&gt;
      waffle.servlet.spi.NegotiateSecurityFilterProvider
  &lt;/param-value&gt;
 &lt;/init-param&gt;
 &lt;init-param&gt;
  &lt;param-name&gt;allowGuestLogin&lt;/param-name&gt;
  &lt;param-value&gt;false&lt;/param-value&gt;
 &lt;/init-param&gt;
 &lt;init-param&gt;
  &lt;param-name&gt;waffle.servlet.spi.NegotiateSecurityFilterProvider/protocols&lt;/param-name&gt;
  &lt;param-value&gt;
      Negotiate
  &lt;/param-value&gt;
&lt;/init-param&gt;
&lt;/filter&gt;

&lt;filter-mapping&gt;
&lt;filter-name&gt;com.company.xxx.xxx.xxx.SecurityFilter&lt;/filter-name&gt;
&lt;url-pattern&gt;/*&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;

&lt;filter-mapping&gt;
&lt;filter-name&gt;WaffleSSOFilter&lt;/filter-name&gt;
&lt;url-pattern&gt;/xxx/xxx/xxx/windowsLogin&lt;/url-pattern&gt;
&lt;/filter-mapping&gt;

&lt;!-- Enabling it disables access to App from other computers --&gt;
&lt;context-param&gt;
&lt;param-name&gt;org.jboss.weld.development&lt;/param-name&gt;
&lt;param-value&gt;false&lt;/param-value&gt;
&lt;/context-param&gt;

&lt;servlet-mapping&gt;
&lt;servlet-name&gt;javax.ws.rs.core.Application&lt;/servlet-name&gt;
&lt;url-pattern&gt;/xxx/*&lt;/url-pattern&gt;
&lt;/servlet-mapping&gt;

&lt;/web-app&gt;
</code></pre>

<p>I got this setup because I stumbled across this little post:
<a href="https://stackoverflow.com/questions/19999406/multiple-filters-with-same-url-mapping">Multiple filters with same url mapping</a></p>

<p>and then I found this post which helped me to get in the correct direction:<a href="https://stackoverflow.com/questions/32967896/java-sso-with-wildfly-8-java-1-8-0-45-and-active-directory">java-sso-with-wildfly-8-java-1-8-0-45-and-active-directory</a></p>

<p>so I try to access this part right here throug the filter WaffleSSOFilter.</p>

<pre><code>public String getUserName( HttpServletRequest servletRequest )
  {
    Enumeration&lt;String&gt; headerNames = servletRequest.getHeaderNames();
    while ( headerNames.hasMoreElements() )
    {
      String headerName = headerNames.nextElement();
      String headerValue = servletRequest.getHeader( headerName );
      log.info( "Header Name:" + headerName + " " + headerValue );
    }
    String remotePrincipal = servletRequest.getRemoteUser();
    log.info( "REMOTE USER: " + remotePrincipal );
    log.info( "PRINCIPAL: " + servletRequest.getUserPrincipal().toString() );
    return remotePrincipal;
  }
</code></pre>

<p>The difficult part on this for me is that the first filter "com.company.xxx.xxx.xxx.SecurityFilter" is needed on every URL, because our application is broken without it and nothing works then. but I need a special POST URL for my WaffleSSOFilter to enable the ability to authenticate over the logged in windows user on the remote machine accessing the website.</p>

<p>The goal is to have the login page with the normal username and password form and have a checkbox to enable the windows authentication. </p>

<p>With this setup I can login normally with username and password. the application is working, which is good so far. Now, if I make a POST request to my special URL to test the windows authentication, I get a java.lang.NullPointerException on the previous source code excactly at accessing <code>servletRequest.getUserPrincipal().toString()</code></p>

<p><strong>Question:</strong> Where is my error in the filter setup or what is wrong with the source code?</p>

<p>PS: Yes I configured my browsers to enable the request as mentioned in the link on the second post. 
PPS: When I remove our first filter and route everything through the waffle filter the login works and I don't get a NullPointerException, the application is completely broken though.</p>