I don't really understand what that means.
A
Servlet filter intercepts URL requests coming in and responses going back. It sort of sounds like you are expecting the filter to jam in extra data on incoming command requests. That's risky at best.
JSF was actually designed to be HTTP-independent. The JSF lifecycle operates in an abstract Model/View/Controller mode, which is why it's so much trouble to even get at the HttpServlet objects themselves. And it's based on Inversion of Control, which means that the JSF code isn't supposed to "go out and get" values, it expects that the values will automatically have been injected in before the action method is executed.
When I need to make an action based on a user's identity, I usually have a session-scope Managed Bean that I can inject (as a Managed Property) into the backing bean that does the business logic. That's pretty much just playing with POJOs and letting JSF do a lot of the work for me. I don't need filters or other HTTP-specific stuff to do that. In fact, I don't even need to reference the FacesContext.