Thank you for this advise. In order to exclude the custom login module as the cause I just used the built-in "Database" login module. And see, there is the same problem: the user name and password are still random values. So I assume it is not the problem of using a custom login module somewhere in an EAR but a general problem...