Why does flushOnSessionInvalidation not work on JBoss EAP 5?
Issue
- We're experiencing problems with our web apps in regards to authentication being cached in EAP 5.1.0. Users can still login with their old password after a password reset, for a duration of ~30 minutes. This did not occur in JBoss 4.0.5. We are specifying
flushOnSessionInvalidationwhen we define the security-domain in our jboss-web.xml file. Logout is done by callingHttpRequest.getSession().invalidate(). After this, trying to re-access the application yields the login page. However, invokingjboss.security:service=JaasSecurityManager.getAuthenticationCachePrincipals("myApp")shows our user as still being in the cache. - Why is the user's JAAS cache entry not getting flushed from the JAAS cache?
Environment
- JBoss Enterprise Application Platform (EAP)
- 5.x
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
