You should be able to get the domain name in use using
You can then use this to know which site the user is visiting for your login.
Thank you for your reply.
Follow up question: Can I access FacesContext.getCurrentInstance().getExternalContext() within a drule security rule?
If you are inside a faces request, you should be able to. But why don't you have a go?