here is an example with the sample-struts-liferay-portlet.
in the web.xml add the following:
<filter>
<filter-name>Auto Login Filter</filter-name>
<filter-class>com.liferay.portal.kernel.servlet.PortalClassLoaderFilter</filter-class>
<init-param>
<param-name>filter-class</param-name>
<param-value>com.liferay.portal.servlet.filters.autologin.AutoLoginFilter</param-value>
</init-param>
</filter>
<filter>
<filter-name>Servlet Authorizing Filter</filter-name>
<filter-class>com.liferay.portal.kernel.servlet.PortalClassLoaderFilter</filter-class>
<init-param>
<param-name>filter-class</param-name>
<param-value>com.liferay.portal.servlet.filters.external.ServletAuthorizingFilter</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>Auto Login Filter</filter-name>
<url-pattern>/test_session/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>Servlet Authorizing Filter</filter-name>
<url-pattern>/test_session/*</url-pattern>
</filter-mapping>
The result is that the session becomes shared between the portlet and the servlet. As well the req.getRemoteUser() and calls requiring access to the user principle succeed where before they would not.
The side effect of this solution seems to be that we get the same session for servlets in the portlet war as the portlet, which is very cool, but I'm not sure if this side effect will be the same on other app servers/containers (I've only tested tomcat55).
Anyone having details on this please pipe in.