Does JBoss cache authentication information?
authentication, caching, jboss
Solution
Yes, JBoss caches authentication information by default for a few minutes.
To disable caching, set DefaultCacheTimeout to 0 in the configuration for the JaasSecurityManagerService. The configuration is in the "jboss-service.xml" file.
For more info and various ways to flush the cache, see CachingLoginCredentials at jboss.org.
Problem
When testing various authentication solutions (my own LoginModule etc) in JBoss, it seemed to me that sometimes when I redeployed a change or otherwise provoked the login form to show, that JBoss didn't actually call the authentication module. Just wondering if there is some type of short term caching going on? I tested both from a web application (taking care to delete cookies etc) and from a fat RMI java client. Of course, If I restarted JBoss, the full authentication process was followed. Is there a cache, and if so, can it be disabled for development purposes?