Within a servlet the request / session / application attributes are availbale from within doGet(HttpServletRequest request, HttpServletResponse response) / doPost(HttpServletRequest request, HttpServletResponse response) methods:
//request attributes
String string = (String)request.getAttribute("username");
//session attributes
String string = (String)request.getSession().getAttribute("username");
//application attributes
String string = (String)getServletContext().getAttribute("beanName");
When the request was handled by the FacesServlet, the attributes are available as:
//request attributes
String string = (String)FacesContext.getCurrentInstance().getExternalContext().getRequestMap().get("username");
//session attributes
String string = (String)FacesContext.getCurrentInstance().getExternalContext().getSessionMap().get("username");
//application attributes
String string = (String)FacesContext.getCurrentInstance().getExternalContext().getApplicationMap().get("username");
Suggested reading