[jboss-jira] [JBoss JIRA] (AS7-5728) ClusteredSingleSignOn doesn't remove ssoId from sso cluster on Request.logout

ClusteredSingleSignOn doesn't remove ssoId from sso cluster on Request.logout ----------------------------------------------------------------------------- Key: AS7-5728 URL: https://issues.jboss.org/browse/AS7-5728 Project: Application Server 7 Issue Type: Bug Components: Clustering, Security Affects Versions: 7.1.3.Final (EAP) Reporter: Stian Thorgersen Assignee: Paul Ferraro Attachments: jboss-as-servlet-security.war Logging out a user with Request.logout doesn't work with clustered SSO. This is caused by ClusteredSingleSignOn.deregister(String) not removing the ssoId from the SSO cluster. The ClusteredSingleSignOn.sessionEvent removes it from both the local cache and the SSO cluster, so a workaround is to call Session.invalidate() prior to calling Request.logout().