[jboss-jira] [JBoss JIRA] (WFLY-3221) flushOnSessionInvalidation attribute in jboss-web.xml does not flush user credentials

[Darran Lofthouse (JIRA)]

    [ https://issues.jboss.org/browse/WFLY-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12971947#comment-12971947 ] 

Darran Lofthouse edited comment on WFLY-3221 at 5/30/14 8:32 AM:
-----------------------------------------------------------------

There is no requirement to restart the server, the security domains contain a flush-cache operation that can be called to clear either the whole security domain or a selected principal from the cache.


was (Author: dlofthouse):
There is no requirement to restart the server, the security domains contain a flush-cache method that can be called to clear either the whole security domain or a selected principal from the cache.

> flushOnSessionInvalidation attribute in jboss-web.xml does not flush user credentials
> -------------------------------------------------------------------------------------
>
>                 Key: WFLY-3221
>                 URL: https://issues.jboss.org/browse/WFLY-3221
>             Project: WildFly
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) 
>          Components: Security
>    Affects Versions: 8.0.0.Final
>            Reporter: Jorge Marmolejo
>            Assignee: Darran Lofthouse
>            Priority: Critical
>             Fix For: 9.0.0.Alpha1
>
>
> The attribute flushOnSessionInvalidation  does not flush the user credentials when the session is invalidated or when it times out. If the password or roles change for the user, the only way to get the new changes is by restarting the server.
> I tried removing "cache-type=default" from the standalone-full.xml and it works, but for every action made on the site, the login method in the authentication module is called.



--
This message was sent by Atlassian JIRA
(v6.2.3#6260)