Session.invalidate() does not invalidate SSO context for non-distributable applications

two servers with non-distributable application (requires FORM authentication, user added) and <single-sign-on/> set up create a few requests to both servers, you'll be required to authenticate for the first request you should now have at least two sessions with the same SSO context invalidate one of those sessions by calling session.invalidate() what happens: another request to either of the servers won't require you to authenticate what's expected: you should be required to authenticate again (SSO context should be destroyed) - this happens when the application is <distributable/>*