forcing a Logout will still prompt my custom Login module 3 times

[madalina.grama]

I have a custom Login Module based on a DatabaseServerLoginModule.

If my user uses the app to change his password, I flush the credentials and force a logout (by redirecting him to the logout page).

But somehow the login method will get invoked 3 times after the logout with the old password (and, of course, will fail with LoginException)

#1 I don't know why when redirecting the app to the logout page a login needs to be performed at all. Is there a way I can stop the Login modul from invoking the login() method?

#2 I don't understand what needs to be done in order for the getUsernameAndPassword() method for the DatabaseServerLoginModule to get the new credentials of the user. What else do I need  to flush to get updated credentials?

Thanks.

[wolfgangknauf]

Hi,

does this help? https://community.jboss.org/wiki/CachingLoginCredentials

Best regards

Wolfgang

[madalina.grama]

Thanks.

In the meantine, I've solved the problem: I won't flush the login credentials when the user changes his own password, because certain actions after that will require a login and I did not find a way for the cache to be updated with the new values from the DB.

So when a logout is forced, I leave the cache alone, I perform whatever actions are needed and then a logout servlet is invoked for the logout path I force. I let that Servlet deal with the invalidation of the cache.

Solved things out for me.