"ragavgomatam" wrote : Try calling HttpSession.invalidate(). When you invalidate the session on log out, Jboss automatiocally clears the Principal from its internal cache. Are you saying that instead of calling webAuthentication.logout(), I should call something like this: | HttpSession session = (HttpSession) FacesContext.getCurrentInstance().getExternalContext().getSession(false); | session.invalidate(); | View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4169963#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...