I've changed the filter to always invoke chain.doFliter if the response is not already commited.

It is important to keep in mind that the IDPFilter is only invoked when a security-constraint in web.xml is matched and the user was previously authenticated. For instance:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>SALES Application</web-resource-name>
	    <url-pattern>/protected/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>manager</role-name>
    </auth-constraint>
</security-constraint>

In the case above, only /protected/* resources are going to be processed by the filter.

Can you please try it out to check if it is ok for you ?

Regards.