private void createSubjectAndPushItOnThreadAsNeeded ( HttpServletRequest req , HttpServletResponse res ) { // We got a new instance of FormLogoutExtensionProcess every request. logoutSubject = null ; Subject subject = subjectManager . getCallerSubject ( ) ; if ( subject == null || subjectHelper . isUnauthenticated ( subject ) ) { if ( authService == null && securityServiceRef != null ) { authService = securityServiceRef . getService ( ) . getAuthenticationService ( ) ; } SSOAuthenticator ssoAuthenticator = new SSOAuthenticator ( authService , null , null , ssoCookieHelper ) ; //TODO: We can not call ssoAuthenticator.authenticate because it can not handle multiple tokens. //In the next release, authenticate need to handle multiple authentication data. See story AuthenticationResult authResult = ssoAuthenticator . handleSSO ( req , res ) ; if ( authResult != null && authResult . getStatus ( ) == AuthResult . SUCCESS ) { subjectManager . setCallerSubject ( authResult . getSubject ( ) ) ; logoutSubject = authResult . getSubject ( ) ; } } }
For formLogout this is a new request and there is no subject on the thread . A previous request handled on this thread may not be from this same client . We have to authenticate using the token and push the subject on thread so webcontainer can use the subject credential to invalidate the session .