Okay, so it basically works as outlined above.
Now the CurrentTenantIdentifierResolver I provided is not tied in any way into the EE server.
I currently have (for other purposes) a @SessionScoped bean (say, MyContext) in my Wicket -> EJB integration.
If my CurrentTenantIdentifierResolver implementation had access the MyContext, it really could decide on the right tenant identifier for the current request's user...
Any ideas ? Cheers, Tom.