Hi,
for me, the auth cache is flushed after I call session.invalidate(), however, the auth cache is not flushed when I hot redeploy my WAR and the session is destroyed by this redeploy. I.e. 1. login as user X, 2. change user X password in DB, 3. redeploy the WAR (EAR), 4. try to login as user X. The login pass but should fail.