[
https://issues.jboss.org/browse/WFLY-5473?page=com.atlassian.jira.plugin....
]
Richard Janík updated WFLY-5473:
--------------------------------
Steps to Reproduce:
- two servers with non-distributable application (requires FORM authentication, user
added) and <single-sign-on/> set up
- create a few requests to both servers, you'll be required to authenticate for the
first request
- you should now have at least two sessions with the same SSO context
- invalidate one of those sessions by calling session.invalidate()
- what happens: another request to either of the servers won't require you to
authenticate
- what's expected: you should be required to authenticate again (SSO context should be
destroyed) - this happens when the application is <distributable/>
Session.invalidate() does not invalidate SSO context for
non-distributable applications
---------------------------------------------------------------------------------------
Key: WFLY-5473
URL:
https://issues.jboss.org/browse/WFLY-5473
Project: WildFly
Issue Type: Bug
Components: Clustering, Web (Undertow)
Reporter: Richard Janík
Assignee: Stuart Douglas
Priority: Blocker
See "Steps to Reproduce" for detailed description.
According to my limited knowledge, this was also the core issue in
https://bugzilla.redhat.com/show_bug.cgi?id=924456 which has been dispatched as a one-off
to a customer. Thus, I'm setting the priority to blocker as this is a regression
against 6.4.x. No exceptions have been observed in the server output however.
Adding Clustering component as I've been trying this with standalone-ha.xml and BZ
924456 relates to clustering.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)