Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-1282

Calling HttpServletRequest.logout() with single sign-on enabled only works every second time

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Blocker
    • 7.0.0.ER5
    • 7.0.0.DR10, 7.0.0.DR11, 7.0.0.DR13 (Alpha), 7.0.0.ER2 (Beta), 7.0.0.ER3
    • Undertow
    • None
    • Hide
      • start EAP server with <single-sign-on/> enabled and a user added
      • deploy a <distributable/> application with FORM authentication enabled
      • create a request for the deployment and authenticate
      • logout from the application by calling HttpServletRequest.logout()
      • create a request
      • what is expected: you should authenticate for this request
      • what happens: you are still considered authenticated
      • logging out for the second time works as expected
      Show
      start EAP server with <single-sign-on/> enabled and a user added deploy a <distributable/> application with FORM authentication enabled create a request for the deployment and authenticate logout from the application by calling HttpServletRequest.logout() create a request what is expected: you should authenticate for this request what happens: you are still considered authenticated logging out for the second time works as expected

    Description

      See "Steps to Reproduce". Logging out from an application only works every second time, e.g. HttpRequestServlet.logout() has to be called twice in order to have any effect

      This doesn't occur without <single-sign-on/> enabled - logout() has the expected effect. The issue is security related, thus I'm adding our security team members as watchers.

      Attachments

        Issue Links

          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-5785 [7.1.x] Calling HttpServletRequest.logout() with single sign-on enabled only works every second time

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Verified

          Bug - A problem that impairs or prevents the functions of the product. WFLY-5484 Calling HttpServletRequest.logout() with single sign-on enabled only works every second time

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Closed

          Activity

            People

              remerson@redhat.com Ryan Emerson
              rjanik@redhat.com Richard Janik
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: