http://community.jboss.org/wiki/CachingLoginCredentials

I've tried basically all of the above to make sure that a Principal that is logged in and wishes to delete his account is properly logged out so that his Principal is no longer cached by the JaasSecurityManagerService.

We've already had all of the below:

• (new WebAuthentication).logout()
• HttpSession.invalidate()
• add flushOnSessionInvalidation="true" to jboss-web.xml

Tried adding code to Programatic Flushing via JMX, but did not have any effect.

Disabling Caching

• this worked, but was unacceptable, seeing as the amount of attempts to authorize using the database increased dramatically.

• currently we have a DefaultCacheTimeout set to 9600 seconds, and after that time, the account is indeedy removed from the Cache and the database is once more contacted to retrieve the Principal