start EAP server with <single-sign-on/> enabled and a user added deploy a <distributable/> application with FORM authentication enabled create a request for the deployment and authenticate logout from the application by calling HttpServletRequest.logout() create a request what is expected: you should authenticate for this request what happens: you are still considered authenticated logging out for the second time works as expected