I have a javaee application that I migrated from a weblogic server application to tomEE. The problem I have is that it does not pass the BeforeLoginFilter filter when sending the request. This works correctly in weblogic but not in Tomee.
The code of my project is as follows:

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
    http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
         id="WebApp_ID" version="3.0">

    <display-name>Tomcat JAAS example</display-name>

    <servlet>
        <description>desc</description>
        <display-name>AuthorizationEndpoint</display-name>
        <servlet-name>AuthorizationEndpoint</servlet-name>
        <servlet-class>com.example.account.myservlet.AuthorizationEndpoint</servlet-class>
        <init-param>
            <param-name>configFile</param-name>
            <param-value>${config.basename}</param-value>
        </init-param>
    </servlet>
    <servlet-mapping>
        <servlet-name>AuthorizationEndpoint</servlet-name>
        <url-pattern>/server/authorize</url-pattern>
    </servlet-mapping>

    <servlet>
        <servlet-name>LoginServlet</servlet-name>
        <servlet-class>com.example.account.myservlet.LoginServlet</servlet-class>
        <init-param>
            <param-name>configFile</param-name>
            <param-value>${config.basename}</param-value>
        </init-param>
    </servlet>
    <servlet-mapping>
        <servlet-name>LoginServlet</servlet-name>
        <url-pattern>/login</url-pattern>
    </servlet-mapping>

    <servlet>
        <servlet-name>ProcessLoginServlet</servlet-name>
        <servlet-class>com.example.account.myservlet.ProcessLoginServlet</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>ProcessLoginServlet</servlet-name>
        <url-pattern>/process-login</url-pattern>
    </servlet-mapping>

    <filter>
        <filter-name>BeforeLoginFilter</filter-name>
        <filter-class>com.example.account.filter.BeforeLoginFilter</filter-class>
        <init-param>
            <param-name>otpUrl</param-name>
            <param-value>/otp</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>BeforeLoginFilter</filter-name>
        <servlet-name>LoginServlet</servlet-name>
    </filter-mapping>

    <filter>
        <filter-name>PreLoginFilter</filter-name>
        <filter-class>com.example.account.filter.PreLoginFilter</filter-class>
        <init-param>
            <param-name>loginCheckUrl</param-name>
            <param-value>/process-login</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>PreLoginFilter</filter-name>
        <servlet-name>AuthorizationEndpoint</servlet-name>
    </filter-mapping>

    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Admin</web-resource-name>
            <!-- Define the context-relative URL(s) to be protected -->
            <url-pattern>/process-login</url-pattern>
            <!-- If you list http methods, only those methods are protected -->
            <http-method>GET</http-method>
        </web-resource-collection>
        <auth-constraint>
            <!-- Anyone with one of the listed roles may access this area -->
            <role-name>admin</role-name>
        </auth-constraint>
    </security-constraint>

    <!-- Security roles referenced by this web application -->
    <security-role>
        <role-name>admin</role-name>
    </security-role>

    <!-- Default login configuration uses form-based authentication -->
    <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>myrealm</realm-name>
        <form-login-config>
            <form-login-page>/login</form-login-page>
            <form-error-page>/error.html</form-error-page>
        </form-login-config>
    </login-config>

</web-app>

PreLoginFilter.java

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class PreLoginFilter implements Filter {
    private String loginCheckUrl;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        System.out.println("PreLoginFilter" + "##" + "init");
        this.loginCheckUrl = filterConfig.getInitParameter("loginCheckUrl");
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        System.out.println("PreLoginFilter" + "##" + "doFilter");
        HttpServletRequest req = (HttpServletRequest) request;
        HttpServletResponse resp = (HttpServletResponse) response;
        resp.sendRedirect(req.getContextPath() + loginCheckUrl);
    }

    @Override
    public void destroy() {
        System.out.println("PreLoginFilter" + "##" + "destroy");
    }
}

BeforeLoginFilter

import ir.tamin.account.utils.AuthStatus;
import ir.tamin.account.utils.ServletProperties;
import org.jose4j.base64url.Base64;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class BeforeLoginFilter implements Filter {

    private static final Logger LOGGER = LoggerFactory.getLogger(PreLoginFilter.class);

    private String otpUrl;

    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException, IOException {
        HttpServletRequest request = ((HttpServletRequest) req);
        HttpServletResponse response = ((HttpServletResponse) resp);
        if(request.getUserPrincipal() != null && !request.getUserPrincipal().getName().isEmpty()) {
            if (AuthStatus.PARTIALLY_AUTHENTICATED == request.getSession().getAttribute(ServletProperties.AUTH_STATUS)) {
                LOGGER.info("session is partially authenticated, so client is being sent to {} for otp processing", otpUrl);
                response.sendRedirect(request.getContextPath() + otpUrl);
                return;
            } else {
                LOGGER.info("session is authenticated, need not to login");
                String url = (String) request.getSession().getAttribute(ServletProperties.ORIGINAL_REQUEST);
                response.sendRedirect(new String(Base64.decode(url)));
                return;
            }
        }
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {

    }

    public void init(FilterConfig config) throws ServletException {
        this.otpUrl = config.getInitParameter("otpUrl");
    }

}

I expect that after sending the request request, first enter the PreLoginFilter filter and then resp.sendRedirect(req.getContextPath() + loginCheckUrl); Enter the BeforeLoginFilter filter from the doFilter method. It works properly in Weblog, but it doesn’t pass the BeforeLoginFilter filter in Tomee.