undertow-io/undertow — pull request #166 by mikesir87 (2014-02-01 05:42:31+00:00)
Title: Clear cached session when IdentityManager declares Account is invalid

When an IdentityManager declares an Account is invalid, challenges are
resent. Upon the next request (which may occur based on an OAuth/CAS
redirect back), the CachedAuthenticatedSessionMechanism is invoked first
and finds a cached AuthenticatSession. It runs the Account against the
IdentityManager, which still declares it invalid and challenges are sent
again. A forever redirect loop occurs.

This request clears the cached AuthenticatedSession from the session,
allowing subsequent requests to invoke the authenticate methods on the
registered AuthenticationMechanisms and allowing authentication to
actually occur.