code: public String getRemoteUser()
      {
          if (WCCustomProperties.CHECK_REQUEST_OBJECT_IN_USE){
              checkRequestObjectInUse();
          }
          String remoteUser = null;
          Principal principal = getUserPrincipal();
          if (principal == null) {
              //remoteUser = null;
  
              if (_request != null) {
                  remoteUser = _request.getRemoteUser();
              }
  
          } else {
              remoteUser = principal.getName();
              if (TraceComponent.isAnyTracingEnabled()&&logger.isLoggable (Level.FINE)) {
                  logger.logp(Level.FINE, CLASS_NAME, "getRemoteUser", "(security enabled)");
              }
          }
          if (TraceComponent.isAnyTracingEnabled()&&logger.isLoggable (Level.FINE)) {  //306998.15
              logger.logp(Level.FINE, CLASS_NAME, "getRemoteUser", "user=" + remoteUser);
          }
          return remoteUser;
      }
docs: Returns the name of the user making this request, or null if not
  known. Same as the CGI variable REMOTE_USER.
  This logic is delegatd to the registered IWebAppSecurityCollaborator.