OK, answering my own question - partially.

I found how to do the programatic login in the glassfish developer guide.
(before I was looking in just the J5EE docs)

Logins work fine, but it still depends on knowing the user's password. So that
makes it impossible to log them in with a "remember me" token.

Anyone know of a good solution for that? The only thing that comes to my mind
is:

- Set up a separate JDBCRealm that uses the login token for password - In the filter, look up username by token - Do login against 2nd realm with username and token

Having two realms set up doesn't seems ideal, but should to the trick. Any other
suggestions? [Message sent by forum member 'basscheffers' (basscheffers)]

http://forums.java.net/jive/thread.jspa?messageID=262098