Logout in J2EE???

[anbenham]

Hi,
I am using JAAS for my J2EE application, with JSP frontend. I would like to place a "logout"-link.
Authentication is formbased.
Now, how to enforce logout, so that the subject ist resetted, and access is denied for the application?

[mikefinn]

Shoudn't session.invalidate() do what you need?

Mike

[gouldm]

Should this also prevent you from accessing any ejb's with security applied to them? If for example I had a page without security that the user browsed to after they had 'logged out', but there were some ejb's *with* security, would the ejb's execute?

Thanks,

Mark.

[juha]

No, there's no security context propagation from unprotected servlets to EJBs.

-- Juha