[ https://issues.jboss.org/browse/WFLY-5473?page=com.atlassian.jira.plugin.... ] Richard Janík updated WFLY-5473: -------------------------------- Attachment: reproducer.zip I've attached the reproducer. Unzip it into a clean installation of EAP/Wildfly and run the reproducer.sh script. I've been reproducing the issue manually before. I've been investigating some more while writing the reproducer and found that there are cases where it works - invalidation destroys SSO context - and cases where it doesn't work. It works only if you invalidate the first session of the given SSO context. Here's an example (roughly the same thing the reproducer does): * Start two servers, each with <single-sign-on/>, a user and a non-distributable deployment. Bind server1 to 127.0.0.1:8080 and server2 to 127.0.0.1:8180. * Open browser (Firefox), GET 127.0.0.1:8080/deployment, authenticate - we get JSESSIONID "x1" and JSESSIONIDSSO "y1" * GET 127.0.0.1:8180/deployment, (no need to authenticate), we get JSESSIONID "x2" and JSESSIONIDSSO "y1" * GET 127.0.0.1:8080/deployment, (no need to authenticate), we get JSESSIONID "x3" and JSESSIONIDSSO "y1" * invalidate session on 127.0.0.1:8080 (JSESSIONID "x3"), then get 127.0.0.1:8080/deployment - we're not required to authenticate, but we should be * when I spoofed the cookies in step 4 (before accessing 127.0.0.1:8080 and creating a second session on that server) and invalidated session with JSESSIONID "x1", it worked -- This message was sent by Atlassian JIRA (v6.4.11#64026)