JAAS in servlet engine
Hi,
I want to use an existing JAAS loginmodule in Tomcat. I don't want to use the built in JAASRealm functionality of Tomcat. In a JSF managed bean (called AuthenticationBean) I create a LoginContext and call it's login method. When the user logs out, the invalidate method of the HttpSession is called to trigger the SessionListener. In the SessionListener the logout method of the LoginContext should be called. Is it good practice to store the LoginContext in the user's session to share this object between the SessionListener and the AuthenticationBean? Shouldn't it be serializable then?
Or is it allowed to create another LoginContext in the SessionListener to call the logout method on? So, is it mandatory to instantiate just one instance of the LoginContext per user authentication?
Kind regards,
Dirk
