Please add information about changed interface 'org.jboss.security.AuthenticationManager' to 6.4.0 Release notes. There was added logout() method in 6.4.0.DR11. Customers may hit this change if they use for instance a custom ServerAuthenticationModule (part of JBoss implementation of JSR-196 - JASPIC): <valve> <class-name>org.jboss.as.web.security.jaspi.WebJASPIAuthenticator</class-name> <param> <param-name>serverAuthenticationManagerClass</param-name> <param-value>com.acme.ServerAuthenticationManager</param-value> </param> </valve> Related PicketBox commit: http://git.app.eng.bos.redhat.com/git/picketbox.git/commit/?h=4.1.0.Final-redhat&id=c3bb93dd350df5c23c25904b878e8dd9445b6e9c @Stephan: Could you please provide a doc_text for the change? Thank you.