Perhaps the comment text needs tweaking. JBoss is not engaging in bad behavior here such that it merits a bug report. The JAAS framework supports the notion of periodic reauthentications, but that is at odds with the implementation here which naturally is based on a one-time-use credential (ST). Since the credential by its nature cannot be reused, which is fundamentally different that what many JAAS plugins accept (user/pass, X.509 cert), a cache is required to provide acceptable behavior. Thus the behavior really only applies to JAAS+CAS.

If you'd like to suggest alternative comment text that's perhaps less alarming, more succinct or otherwise improved, I'd be obliged. Addtionally, if you'd like to blog about it and cite the reference here, that would be fine as well.