[ https://issues.jboss.org/browse/SECURITY-876?page=com.atlassian.jira.plug... ] Arjan t commented on SECURITY-876: ---------------------------------- After some more experimenting with this, the following handler seems to do the trick as a workaround, but it's a bit nasty to require this of course. It now uses the hardcoded "other" domain. {code:java} public final class AuthEventHandler implements HttpHandler { private static final Logger log = Logger.getLogger(AuthEventHandler.class); private final HttpHandler next; public AuthEventHandler(final HttpHandler next) { this.next = next; } @Override public void handleRequest(HttpServerExchange exchange) throws Exception { exchange.getSecurityContext().registerNotificationReceiver(new SecurityNotificationReceiver(exchange)); next.handleRequest(exchange); } private static class SecurityNotificationReceiver implements NotificationReceiver { private final HttpServerExchange exchange; public SecurityNotificationReceiver(HttpServerExchange exchange) { this.exchange = exchange; } @Override public void handleNotification(final SecurityNotification notification) { switch (notification.getEventType()) { case LOGGED_OUT: try { // For for when calling request#logout, the authenticated identity is still available for the // EJB context // Clear old one SecurityContextAssociation.clearSecurityContext(); SecurityRolesAssociation.setSecurityRoles(null); // Set a new one in case re-authentication is done within the same thread SecurityContext securityContext = SecurityContextFactory.createSecurityContext("other"); if (exchange != null) { exchange.putAttachment(SECURITY_CONTEXT_ATTACHMENT, securityContext); } SecurityContextAssociation.setSecurityContext(securityContext); } catch (Exception e) { log.error("Could not clear EJB security context", e); } break; default: break; } } } } {code} -- This message was sent by Atlassian JIRA (v6.3.11#6341)