[ https://issues.jboss.org/browse/WFLY-3221?page=com.atlassian.jira.plugin.... ] Pavel Kovalenko commented on WFLY-3221: --------------------------------------- Hi guys. I think it's very critical bug and must be resolved as fast as possible. E.g. in my application I use LDAP and roles changes very often, so I can't reboot server after every change. I was hoping that it will fix in 8.1.0.Final and after I noticed that fix version was changed to 9.0.0.Aplha I was frustrated. I realized that I could not wait any longer and after exploring Wildfly source code I found solution for this problem. Next 2 classes flushes credentials after session destroying. {code:title=CredentialsCatchFilter.java|borderStyle=solid} @WebFilter(urlPatterns = "*") public class CredentialsCatchFilter implements Filter { @Override public void init(FilterConfig filterConfig) throws ServletException { } public void doFilter(ServletRequest request, ServletResponse response, FilterChain next) throws IOException, ServletException { if (request instanceof HttpServletRequest) { HttpServletRequest httpServletRequest = (HttpServletRequest) request; if (httpServletRequest.getSession().getAttribute("principal") == null && httpServletRequest.getUserPrincipal() != null) { httpServletRequest.getSession().setAttribute("principal", httpServletRequest.getUserPrincipal()); } } next.doFilter(request, response); } @Override public void destroy() { } } {code} {code:title=FlushCredentialsListener.java|borderStyle=solid} @WebListener public class FlushCredentialsListener implements HttpSessionListener { @Resource(name = "java:jboss/jaas/ldap/authenticationMgr") private CacheableManager<?, Principal> authenticationManager; @Override public void sessionCreated(HttpSessionEvent httpSessionEvent) { } @Override public void sessionDestroyed(HttpSessionEvent httpSessionEvent) { Principal principal = (Principal) httpSessionEvent.getSession().getAttribute("principal"); if (principal != null) authenticationManager.flushCache(principal); } } {code} *Note:* In Resource annotation use your security domain name instead of "ldap". Hope, it will help developers to temporarily resolve this problem before official fix. -- This message was sent by Atlassian JIRA (v6.2.3#6260)