As it works today in JBoss the security cache isn't distributed in a clustered environment. A customer of us has ask about a problem they have when they need to remove a user from the system then they need to manually (or using an app) traverse all node in the cluster and flush the cache each node.
They thought that it should be enough to flush on one node and this will go to all other nodes also but that is not the case obviously since the cache is not distributed.
Cache policy that is in use is TimedCachePolicy. I've noticed that there is a DistributedTimedCachePolicy also. Would it be possible to use that one instead!?
/L
