UNDERTOW-269 SSO not destroyed when the last associated session times…

… out
undertow-io · Jun 26, 2014 · 4f6f18c · 4f6f18c
1 parent a899ef6
commit 4f6f18c
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/core/src/main/java/io/undertow/security/impl/SingleSignOnAuthenticationMechanism.java b/core/src/main/java/io/undertow/security/impl/SingleSignOnAuthenticationMechanism.java
@@ -169,7 +169,11 @@ public void sessionDestroyed(Session session, HttpServerExchange exchange, Sessi
                         if (reason == SessionDestroyedReason.INVALIDATED) {
                             for (Session associatedSession : sso) {
                                 associatedSession.invalidate(null);
+                                sso.remove(associatedSession);
                             }
+                        }
+                        // If there are no more associated sessions, remove the SSO altogether
+                        if (!sso.iterator().hasNext()) {
                             manager.removeSingleSignOn(ssoId);
                         }
                     } finally {