[jboss-jira] [JBoss JIRA] (WFLY-3221) flushOnSessionInvalidation attribute in jboss-web.xml does not flush user credentials

[valsaraj viswanathan (JIRA)]

    [ https://issues.jboss.org/browse/WFLY-3221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13189793#comment-13189793 ] 

valsaraj viswanathan commented on WFLY-3221:
--------------------------------------------

Thanks for sharing. I tried SessionListener fix. It worked for logged in user but during logout I got "javax.ejb.EJBAccessException: JBAS013323: Invalid User" exception because I have SessionAttribute listeners which calls EJB when attributes removed. So when session listener flushes cache, all EJB calls after this gets invalid user. Any work around for this scenario?
(Restricted to jira-users group)
> flushOnSessionInvalidation attribute in jboss-web.xml does not flush user credentials
> -------------------------------------------------------------------------------------
>
>                 Key: WFLY-3221
>                 URL: https://issues.jboss.org/browse/WFLY-3221
>             Project: WildFly
>          Issue Type: Bug
>          Components: Security
>    Affects Versions: 8.0.0.Final
>            Reporter: Jorge Marmolejo
>            Assignee: Stuart Douglas
>            Priority: Critical
>             Fix For: 9.0.0.Beta1
>
>
> The attribute flushOnSessionInvalidation  does not flush the user credentials when the session is invalidated or when it times out. If the password or roles change for the user, the only way to get the new changes is by restarting the server.
> I tried removing "cache-type=default" from the standalone-full.xml and it works, but for every action made on the site, the login method in the authentication module is called.



--
This message was sent by Atlassian JIRA
(v6.4.11#64026)