Does JBoss cache authentication information?

Question

When testing various authentication solutions (my own LoginModule etc) in JBoss, it seemed to me that sometimes when I redeployed a change or otherwise provoked the login form to show, that JBoss didn't actually call the authentication module.

Just wondering if there is some type of short term caching going on?

I tested both from a web application (taking care to delete cookies etc) and from a fat RMI java client.

Of course, If I restarted JBoss, the full authentication process was followed.

Is there a cache, and if so, can it be disabled for development purposes?

Answer 1

Yes, JBoss caches authentication information by default for a few minutes.

To disable caching, set DefaultCacheTimeout to 0 in the configuration for the JaasSecurityManagerService. The configuration is in the "jboss-service.xml" file.

For more info and various ways to flush the cache, see CachingLoginCredentials at jboss.org.