Bug 1062101 – JAAS login module's logout() method is not invoked removing cache-type

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1062101 - JAAS login module's logout() method is not invoked removing cache-type

Summary:	JAAS login module's logout() method is not invoked removing cache-type

Status:	VERIFIED

Aliases:	None

Product:	JBoss Enterprise Application Platform 6
Classification:	JBoss
Component:	Security (Show other bugs)
Sub Component:
Version:	6.2.0,6.3.0
Hardware:	Unspecified Unspecified

Priority	urgent Severity high
Target Milestone:	DR11
Target Release:	EAP 6.4.0
Assigned To:	Stefan Guilhen
QA Contact:	Pavel Slavicek
Docs Contact:

URL:
Whiteboard:	MustBeFixed
Keywords:

Depends On:	1160715
Blocks:	1168863
	Show dependency tree / graph

Reported:	2014-02-06 01:54 EST by Hisanobu Okuda
Modified:	2018-06-07 17:30 EDT (History)
CC List:	7 users (show)

See Also:	1062104
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Hisanobu Okuda 2014-02-06 01:54:37 EST

Description of problem:
By default (cache-type="default"), HttpServletRequest.logout() invokes JAAS login module's logout().
Removing cache-type attribute from <security-domain/>, HttpServletRequest.logout() does not invoke JAAS login module's logout().

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 Ivo Studensky 2014-09-05 03:33:51 EDT

The issue here is that JBossGenericPrincipal is never provided with LoginContext. Hence GenericPrincipal.logout() cannot call a logout on it. 
If cached the LoginContext is stored within DomainInfo and logout is executed within a flushCache method invocation.

Comment 6 Josef Cacek 2014-11-28 08:30:57 EST

Verified in 6.4.0.DR11.

Note You need to log in before you can comment on or make changes to this bug.