Standard warning: writing your own login processor is a
bad idea. J2EE has a much more secure processor built into the J2EE specification which integrates into the J2EE APIs and the appserver.
It would be a lot easier to read your sample definitions if you would
https://coderanch.com/how-to/java/UseCodeTags, though.
I'm afraid that I can't tell anything by looking at your samples. They are hard to read, but seem to be basically correct. Although I'm not sure that you realize that the valueChangeListener doesn't fire until the "Login" button is clicked. Listeners do not fire AJAX events. Or any other kind of asynchronous event. In fact, they don't fire events, period - they listen to events.