Project: Tomcat
Bug 39231 The JAAS contract for LoginModule is broken
Reported: 2006-04-06 21:19:49 | Status: resolved fixed

The issue is that the custom JAAS's LoginModule.logout() method is never called. I guess this has been never implemented correctly (at least since Tomcat 5.5.9). The thing is that according to the JAAS spec, the LoginContext.logout() is supposed to invoke the logout method for each LoginModule configured for this LoginContext. So, somebody should be sure to call LoginContext.logout() method. The caller for this method could be either a server or a client. So, either Tomcat should provide some means to access the LoginContext to the clients, or Tomcat should take the responsibility to call this method by itself. I guess the solution could be for Tomcat to associate the instance of LoginContext with the user's session, and then Tomcat could invoke LoginContext.logout() when the session is being invalidated (both when the session times out or invalidated explicitely). I hope that I am correctly interpreting the JAAS spec.

Files changed in fix:
java/org/apache/catalina/realm/GenericPrincipal.java java/org/apache/catalina/realm/JAASRealm.java java/org/apache/catalina/session/StandardSession.java