The isDescendant operator works a little different that you may think. It is intended to work with folders. It is not recommended to navigate to the /portlet/myportletapplication___myportlet instance of your portlet directly. Normally you would create a folder, put a instance of that portlet in that folder, then use isDescendant on the alias of that folder (or one of it’s parent folders).
Following your instructions, I created a folder “foo” under Public Folders and gave it the alias “bar”. I then added my portlet to it and changed the locale rule to say:
Changing the rule back to only checking the role makes it work just fine. I tried some more and stumbled upon something quite interesting: If I use a condition that checks for a specific string in the request URL with “matches”, the rule works when I use the URL before login (being first redirected to the login page), but not when I access the login page first and then go to my URL.
So it seems to me the rule is run only once after login (but before regarding the portal resource). The solution via the request URL is an acceptable workaround for me.
I can offer a sample deployment package if anyone is interested …