[JBoss-user] AW: Webapp + JAAS: user's principals not updated at second login?

[mehrdad . ashrafi]

Title: Nachricht

Hi, That is right, as you know, each authentication section in login-config.xml has a cache and these caches will managed by JaasSecurityManagerService each entry in this cache is a timed base entry and all of them has an exp-time that is by default 1800, As you know each access on your beans ( entity , SLSB , SFSB  , ... ) is secured under its Security domain , so if you don’t want to have a cache then for each method call on these beans you need a communication with db to make authentication , and it makes your application too slow But, what you want is only make a flush after each change on db, if you have not any chance to make your changes with Jboss, and you have to do that only on db with db tools and query , then you can write a stored procedure or triger after changes on your tables to call a java application , and then you can call flush method remotely. this method is also available remotely under service=JaasSecurityManager service name As you know JAAS is not only for authentication but also for authorization. I hope it helps you ;) -----Ursprüngliche Nachricht----- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Im Auftrag von Keysers, Wonne Gesendet: Donnerstag, 27. Februar 2003 14:54 An: [EMAIL PROTECTED] Betreff: Webapp + JAAS: user's principals not updated at second login? Hi,   We have a web application with declarative security. The custom login module we wrote, fetches the user's credential(s) and role principals from a database.   The first time a user logs in, everything works fine. Meaning that the login() and commit() methods are called.   But wen the user closes his browser and logs in again, these methods are not called any more? (caching mechanism?) Consequently, if the user's role(s) might have been changed in the database, the new settings would not be active?! (When we do flushAuthenticationCache and try again, database access does occur)   How can we prevent this, so the Subject's principals are ALWAYS updated?   Thanks in advance! Wonne Keysers   PS: using jboss-3.0.6