[jboss-jira] [JBoss JIRA] (WFLY-3221) flushOnSessionInvalidation attribute in jboss-web.xml does not flush user credentials

[Michael Davis (JIRA)]

    [ https://issues.jboss.org/browse/WFLY-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13019592#comment-13019592 ] 

Michael Davis edited comment on WFLY-3221 at 11/12/14 10:36 PM:
----------------------------------------------------------------

Pavel Kovalenko, thanks so much for submitting that code. It totally saved my hide tonight.

My use case is: An administrator wants to change someone else's password so that they can either log in or be locked out.

So I didn't want to flush the cache when the current user logged out but rather when we changed someone's password. It was trivial, after looking at your code.

Cheers,
Michael Davis
Ottawa



was (Author: damaru):
Pavel Kovalenko, thanks so much for submitting that code. It totally saved my hide tonight.

My use case is: An administrator wants to change someone else's password so that they can either log in or be locked out.

So I didn't want to flush the cache when the current user logged out but rather when we changed someone's password. It was trivial, after looking at you code.

Cheers,
Michael Davis
Ottawa


> flushOnSessionInvalidation attribute in jboss-web.xml does not flush user credentials
> -------------------------------------------------------------------------------------
>
>                 Key: WFLY-3221
>                 URL: https://issues.jboss.org/browse/WFLY-3221
>             Project: WildFly
>          Issue Type: Bug
>          Components: Security
>    Affects Versions: 8.0.0.Final
>            Reporter: Jorge Marmolejo
>            Assignee: Stuart Douglas
>            Priority: Critical
>             Fix For: 9.0.0.Beta1
>
>
> The attribute flushOnSessionInvalidation  does not flush the user credentials when the session is invalidated or when it times out. If the password or roles change for the user, the only way to get the new changes is by restarting the server.
> I tried removing "cache-type=default" from the standalone-full.xml and it works, but for every action made on the site, the login method in the authentication module is called.



--
This message was sent by Atlassian JIRA
(v6.3.8#6338)