How to remove a logged user from security context?

[6sic6]

Hi all,
I've got something like this

<security:identity authenticate-method="#{authenticator.authenticate}" />

how can I now remove the authenticated user from the seam security context?
thx

[6sic6]

I mean.. remove programmatically a specific user from the security context

[skajotde]

Maybe Identity.cear() ?

[shane.bryzak]

Identity.unauthenticate() if you don't want to invalidate the user's session, otherwide use Identity.logout().

[6sic6]

Hy guys,
yes I know Identity.logout() method but I don't want to inalidate directly the current user..
I mean, I'm currently logged in as Admin and I'm blocking a specific User. Now I want to logout() this User form the context if he is logged in at the moment. If I try to call Identity.logout() I think that the Admin will be logged out and not the User..
So I need something to retrive the Identity of this User from the context and then call logout() on it I think...?

[shane.bryzak]

Ok, I see what you want now.  The short answer is no, you can't reach across sessions to kill/modify something in someone else's session, the servlet container (and specification) prevents this.  You could potentially hack something to achieve a similar result by having the admin user setting some flag somewhere and then using a servlet filter that checks the flag, and if it is set then invalidate that user.

[mcoffin]

Seam's security is lacking some features in this area.

You can probably do this if you implement Acegi and Spring.

Have a look at this article:

Acegi Concurrent Sessions (kicking logged in users)

Acegi has some nice features like limiting users to a single session.

If you using Rich Faces, you'll have to setup Acegi with JSF.  There's plenty of articles on the net on how to do this.

Hopefully Seam can implement some of these features in the future.

[shane.bryzak]

Feel free to raise this as a feature request in JIRA.

[nuno.caneco]

I really needed that feature, also.
I looked up JIRA and didn't find any feature request.

So I've reported a feature request in this JIRA Issue