@WebFilter
public class AuthFilter implements javax.servlet.Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
// STUB
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {

        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse res = (HttpServletResponse) response;
        UserBean userBean = (UserBean) req.getSession().getAttribute("userBean");
        if (userBean == null || !userBean.isLoggedIn()) {
            res.sendRedirect(req.getContextPath() + "/login.jsf");
        } else {
            chain.doFilter(request, response);
        }
    }

    @Override
    public void destroy() {
// STUB
    }
}

...
    <filter>
        <description>Main Authentification Filter</description>
        <filter-name>AuthFilter</filter-name>
        <filter-class>my.package.fastreports.AuthFilter</filter-class>
        <init-param>
            <param-name>loginPage</param-name>
            <param-value>/login.xhtml</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>AuthFilter</filter-name>
        <url-pattern>/restricted/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
        <dispatcher>ERROR</dispatcher>
    </filter-mapping>
...

@ManagedBean
@SessionScoped
public class UserBean implements Serializable {

    @EJB
    private UserFacade userFacade;
    private String username;
    private String password;
    private User user;

// GETTERS + SETTERS
// .....

    public String doLogin() {
        user = userFacade.getUser(username, password);
        if (user != null) {
            return "/restricted/index?faces-redirect=true";
        } else {
            return "/loginFailed?faces-redirect=true";
        }
    }

    public String doLogout() {
        FacesContext.getCurrentInstance().getExternalContext().invalidateSession();
        return "/login?faces-redirect=true";
    }

    public boolean isLoggedIn() {
        return user != null;
    }

        <h:form>
            <p:panel id="panel" header="Login Page"  >
                <h:panelGrid columns="3">
                    <h:outputLabel for="username" value="Username:" />
                    <p:inputText id="username" value="#{userBean.username}" required="true" />
                    <h:outputLabel for="password" value="Password:" />
                    <p:password id="password" value="#{userBean.password}" required="true" />
                </h:panelGrid>
            </p:panel>
            <p:commandButton value="Submit" update="panel" action="#{userBean.doLogin()}" />
        </h:form>