Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-5473

Session.invalidate() does not invalidate SSO context for non-distributable applications

    Details

    • Steps to Reproduce:
      Hide
      • two servers with non-distributable application (requires FORM authentication, user added) and <single-sign-on/> set up
      • create a few requests to both servers, you'll be required to authenticate for the first request
      • you should now have at least two sessions with the same SSO context
      • invalidate one of those sessions by calling session.invalidate()
      • what happens: another request to either of the servers won't require you to authenticate
      • what's expected: you should be required to authenticate again (SSO context should be destroyed) - this happens when the application is <distributable/>*
      Show
      two servers with non-distributable application (requires FORM authentication, user added) and <single-sign-on/> set up create a few requests to both servers, you'll be required to authenticate for the first request you should now have at least two sessions with the same SSO context invalidate one of those sessions by calling session.invalidate() what happens: another request to either of the servers won't require you to authenticate what's expected: you should be required to authenticate again (SSO context should be destroyed) - this happens when the application is <distributable/>*

      Description

      See "Steps to Reproduce" for detailed description.

      According to my limited knowledge, this was also the core issue in https://bugzilla.redhat.com/show_bug.cgi?id=924456 which has been dispatched as a one-off to a customer. Thus, I'm setting the priority to blocker as this is a regression against 6.4.x. No exceptions have been observed in the server output however.

      Adding Clustering component as I've been trying this with standalone-ha.xml and BZ 924456 relates to clustering.

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  pferraro Paul Ferraro
                  Reporter:
                  rjanik Richard Janik
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  7 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: