not able to get request.getPortletSession().invalidate() wor

[janole]

Hi all

I'm trying to write my own custom login portlet.
The problem is that request.getPortletSession().invalidate(); does not seems to work when a user logs out.

Here is the code:
public void processAction(ActionRequest request, ActionResponse response) throws PortletException, PortletSecurityException, IOException
{
if (request.getParameter("op").equals("logout"))
{
request.getPortletSession().invalidate();
String home = PORTAL_HOME;
response.sendRedirect(home);
}
}

request.getRemoteUser is not null after a call to request.getPortletSession().invalidate();
I'm logging in to JBoss Portal Realm with , in the login form.

If I log in via my custom login portlet, and logs out via default Jboss User portlet everyting works as expected.
When the session times out everyting works as expected.

I have debugged the process via remote debugger, and a call to request.getPortletSession().invalidate(); in my custom login portlet ends up in org.jboss.portal.portlet.impl.PortletSessionImpl.invalidate(), so the underlying HTTP session seems to be invalidated and the portletSession is marked as invalid. (Exactly the same happens when I log out via JBoss User portlet)
But the portletSession still lives on..

Any ideas?

regards
Jan Ole

[janole]

I'm logging in to JBoss Portal Realm with
, in the login form.

should be

I'm logging in to JBoss Portal Realm with , in the login form.

[janole]

One more try

I'm logging in to JBoss Portal Realm with
, in the login form.

should be

I'm logging in to JBoss Portal Realm with form method="POST" action="/portal/login", in the login form.

[theute]

When you invalidate a session, it is invalidated on the following HTTP request. Not the current one.

[janole]

After I have clicked on the logoutlink in my custom portlet, to run the code posted, I type the following URL's (and refreshes the pages by pressing F5 in IE)

http://localhost:1080/portal/index.html?_id=page.solar.infodesk, still logged in

http://localhost:1080/portal/index.html?_id=page.default.admin, still logged in

now I click on the logout link in Jboss User portlet, and type the same URL's, and refresh the pages

http://localhost:1080/portal/index.html?_id=page.solar.infodesk, not logged in

http://localhost:1080/portal/index.html?_id=page.default.admin, not logged in

[theute]

What are you trying to do ?

[janole]

The idea was to make i custom login portlet for logging in to JBoss Portal. In the same portlet I also want to have a logout fuction for user that are logged in.

The reason for doing so, is to have a Portal that are localized and presenting information in the native lanuage.

[theute]

So what does not fit your needs in the current user portlet ?

There is no language per user so far, but will come at some point. You could start by extending the existing portlet.

[janole]

Right now we are bulding a demo portal, and we are short of time. We have to have a localized demo portal with some basic functionallity up and running, in order to invite customers to participate in our project.

JBoss Portal seems promsing, and we might use JBoss Portal in the final project. So in the long term vi might well use the jboss user portlet.

But still I think that portletSession.invalidate() should work in custom portlets.
Could this be a bug, or am I doing somthing wrong?

[theute]

As of today, JBoss portal is localized on web browser's preferences only. (that is often not enough, and we will improve that)

If you are creating a JBoss Portlet, you can call req.logout() to log out.

I will look closer at portletSession.invalidate()

[janole]

Tanks,
I'll try req.logout()

regards
Jan Ole

[janole]

actually, I cant find a method with name logout in either JBossActionRequest or JBossRenderRequest. I'm running JBoss Portal 2.0 Alpha binary.
Is this a new method?

[theute]

This is new, i thought you were using the CVS version sorry.

The Beta 1 just came out, you should start playing with that one. Things changed a lot in the login part.

[janole]

I have just "upgraded" to Beta 1, and I like the new login procedure mutch better.
In fact much has improved. Keep up the good work!

I guess I have to start using CVS version to keep track of the news and improvements.

request.logout() works fine in my custom logout function, and the reason for that is that the function calls HttpServletRequest.invalidate() direct

/**
* Perform a logout.
*/
public void logout()
{
req.getSession().invalidate();
}

but still when i call request.getPortletSessionInvalidate(), invalidating of the session is not done.

I thougt that request.getPortletSessionInvalidate() should do the same thing.
For security reasons we still want to provide easy access to logout in our portlets.

[roy.russo]

It should, as per the api:

public void invalidate()
Invalidates this session (all scopes) and unbinds any objects bound to it.
Invalidating the portlet session will result in invalidating the underlying HttpSession

Throws:
java.lang.IllegalStateException - if this method is called on a session which has already been invalidated

If this is not hapenning, we need to take a closer look at it. Are you not getting the expected behaviour in beta1?