After experiencing some strange errors, I decided to dive into the source. My conclusion is that even if JBossSecurityMgrRealm is meant to be also a Valve (and its functionality needs that) it is NOT loaded as a Valve (at least not in the default distribution).
Does anyone have any insight on that? Am I wrong? Anyone from the developer team, please? I can provide details if needed.