Index: main/java/hudson/model/Hudson.java
===================================================================
--- main/java/hudson/model/Hudson.java	(revision 15956)
+++ main/java/hudson/model/Hudson.java	(working copy)
@@ -1470,7 +1470,19 @@
         this.securityRealm = securityRealm;
         // reset the filters and proxies for the new SecurityRealm
         try {
-            HudsonFilter.get(servletContext).reset(securityRealm);
+        	HudsonFilter filter = HudsonFilter.get(servletContext);
+        	if(filter == null) {
+        		// Fix for #3069: This filter is not necessarily initialized before the servlets;
+        		// We set the security flag to true so that HudsonFilter knows it has to setup
+        		// the security
+        		LOGGER.log(Level.INFO, "HudsonFilter has not yet been initialized: Can't perform security setup for now");
+        		SECURITY_NOT_INITIALIZED = true;
+        	}
+        	else {
+        		LOGGER.log(Level.INFO, "HudsonFilter has been previously initialized: Setting security up");
+        		filter.reset(securityRealm);
+        		LOGGER.log(Level.INFO, "Security is now fully set up");
+        	}
         } catch (ServletException e) {
             // for binary compatibility, this method cannot throw a checked exception
             throw new AcegiSecurityException("Failed to configure filter",e) {};
@@ -3196,6 +3208,10 @@
     public static boolean KILL_AFTER_LOAD = Boolean.getBoolean(Hudson.class.getName()+".killAfterLoad");
     public static boolean LOG_STARTUP_PERFORMANCE = Boolean.getBoolean(Hudson.class.getName()+".logStartupPerformance");
 
+    // Fix for #3069: SECURITY_NOT_INITIALIZED will become true if the filters are not initialized before the servlets
+    // (this is the case on WebSphere) so that HudsonFilter knows it has to set the security up
+    public static boolean SECURITY_NOT_INITIALIZED = false;
+
     private static final Logger LOGGER = Logger.getLogger(Hudson.class.getName());
 
     private static final Pattern ICON_SIZE = Pattern.compile("\\d+x\\d+");
Index: main/java/hudson/security/HudsonFilter.java
===================================================================
--- main/java/hudson/security/HudsonFilter.java	(revision 15956)
+++ main/java/hudson/security/HudsonFilter.java	(working copy)
@@ -23,9 +23,20 @@
  */
 package hudson.security;
 
-import javax.servlet.*;
+import hudson.model.Hudson;
+
 import java.io.IOException;
+import java.util.logging.Level;
+import java.util.logging.Logger;
 
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
 import org.acegisecurity.AuthenticationManager;
 import org.acegisecurity.ui.rememberme.RememberMeServices;
 import org.acegisecurity.userdetails.UserDetailsService;
@@ -42,7 +53,10 @@
  * @since 1.160
  */
 public class HudsonFilter implements Filter {
-    /**
+
+	private static final Logger LOGGER = Logger.getLogger(HudsonFilter.class.getName());
+
+	/**
      * The SecurityRealm specific filter.
      */
     private volatile Filter filter;
@@ -88,6 +102,16 @@
         this.filterConfig = filterConfig;
         // this is how we make us available to the rest of Hudson.
         filterConfig.getServletContext().setAttribute(HudsonFilter.class.getName(),this);
+    	if(Hudson.SECURITY_NOT_INITIALIZED) {
+    		// Fix for #3069: This filter is not necessarily initialized before the servlets;
+    		// If it's the case, we need to initialize it before anything else is processed
+    		LOGGER.log(Level.INFO, "Security wasn't initialized; Initializing it...");
+    		Hudson.SECURITY_NOT_INITIALIZED = true;
+    		SecurityRealm securityRealm = Hudson.getInstance().getSecurityRealm();
+    		reset(securityRealm);
+    		LOGGER.log(Level.INFO, "securityRealm is " + securityRealm);
+    		LOGGER.log(Level.INFO, "Security initialized");
+    	}
     }
 
     /**
@@ -123,7 +147,9 @@
     }
 
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
-        // to deal with concurrency, we need to capture the object. 
+    	LOGGER.entering(HudsonFilter.class.getName(), "doFilter");
+
+    	// to deal with concurrency, we need to capture the object. 
         Filter f = filter;
 
         if(f==null) {
Index: main/java/hudson/security/ChainedServletFilter.java
===================================================================
--- main/java/hudson/security/ChainedServletFilter.java	(revision 15956)
+++ main/java/hudson/security/ChainedServletFilter.java	(working copy)
@@ -23,15 +23,18 @@
  */
 package hudson.security;
 
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
-import java.io.IOException;
-import java.util.Arrays;
-import java.util.Collection;
 
 /**
  * Servlet {@link Filter} that chains multiple {@link Filter}s.
@@ -39,6 +42,9 @@
  * @author Kohsuke Kawaguchi
  */
 public class ChainedServletFilter implements Filter {
+
+	private static final Logger LOGGER = Logger.getLogger(ChainedServletFilter.class.getName());
+	
     // array is assumed to be immutable once set
     protected volatile Filter[] filters;
 
@@ -59,12 +65,20 @@
     }
 
     public void init(FilterConfig filterConfig) throws ServletException {
+    	if(LOGGER.isLoggable(Level.FINEST)) {
+	    	for(Filter f : filters) {
+	    		LOGGER.log(Level.FINEST, "ChainedServletFilter contains: " + f);
+	    	}
+    	}
+    	
         for (Filter f : filters)
             f.init(filterConfig);
     }
 
     public void doFilter(ServletRequest request, ServletResponse response, final FilterChain chain) throws IOException, ServletException {
-        new FilterChain() {
+    	LOGGER.entering(ChainedServletFilter.class.getName(), "doFilter");
+
+    	new FilterChain() {
             private int position=0;
             // capture the array for thread-safety
             private final Filter[] filters = ChainedServletFilter.this.filters;
Index: main/java/hudson/security/SecurityRealm.java
===================================================================
--- main/java/hudson/security/SecurityRealm.java	(revision 15956)
+++ main/java/hudson/security/SecurityRealm.java	(working copy)
@@ -292,12 +292,15 @@
      * @since 1.271
      */
     public Filter createFilter(FilterConfig filterConfig) {
-        Binding binding = new Binding();
+    	LOGGER.entering(SecurityRealm.class.getName(), "createFilter");
+
+    	Binding binding = new Binding();
         SecurityComponents sc = getSecurityComponents();
         binding.setVariable("securityComponents", sc);
         BeanBuilder builder = new BeanBuilder();
         builder.parse(filterConfig.getServletContext().getResourceAsStream("/WEB-INF/security/SecurityFilters.groovy"),binding);
         WebApplicationContext context = builder.createApplicationContext();
+        
         return (Filter) context.getBean("filter");
     }
 
