I recently upgraded from JBoss 5.1.0 to 5.2.0. I noticed that JBossSX is utilized for the initial login for a given user/password. If the same user logs in again (with the same password), JBossSX is bypassed. If a different user logs in, or if the same user logs in again with a different password, JBossSX is utilized.
Login form:
- j_username
- j_password
- j_role
So, if j_username and j_password are the same as a previous login, JBossSX is bypassed. If j_role is different, JBossSX is not bypassed. (I assume this is because j_role is not a standard security/login parameter.) If either j_username or j_password change, JBossSX is utilized. (When I say that JBossSX is "utilized", I mean that I get hits on breakpoints that I have peppered throughout my JBossSX implementation.)
In login-config.xml, I am using an application-policy with a custom login-module (AbstractServerLoginModule implementation). In this application-policy, two module-options are defined:
1.) debug: false
2.) serverLogin.url: the URL of my authentication action
It almost seems as if JBoss is caching the authenticated session or implementing a sneaky (and in my case undesired) single sign on. I'm wondering if there's a new setting in JBoss 5.2.0 which enables this caching/SSO type behavior.
Closing the browser between logins does not change the behavior.
(If you're wondering why this is a problem, it is because I need the application to take into consideration which role was selected at login. This role is set in my identity (i.e., UserPrincipal) and is used throughout my application. When I get the HttpServletRequest from ServletActionContext, and I get the UserPrincipal from that request, it is the UserPrincipal from the initial login, and thus the old/incorrect role.)
