ADF security logout not working

Question

Hi,
Using ADF Faces and JDeveloper 11.1.1.1.0 (5407).
I have a secure ADF application, my login is working fine, however once I attempt to perform a logout using methods indicated in both the Fusion Developer's Guide and various blog posts my application begins to act strangely.
Using the Forms based authentication I have login.html and error.html setup and working.
I have a home.jspx (unsecured, no bindings whatsoever) as my landing page, and welcome.jspx as my successful authentication redirect page, both on my adfc-config diagram and with a control flow case 'login' between them.
In my jazn-data.xml file I have granted the 'authenticated-role' access to the welcome page.
The web.xml file includes the login.html and error.html files listed.
The above works, I can login and am successfully redirected to the welcome page with a user account I have specified, and if I use wrong login information I am redirected to error.html.
Now, I have tried 2 methods to get LOGOUT working properly and both are not working.
Firstly and most simply I tried using the following on my welcome page:
<af:commandNavigationItem text="Logout" id="cni1" destination="/adfAuthentication?logout=true&amp;end_url=faces/home.jspx"/>When I click the link, this does redirect me to the home page and there are no warnings/errors in the server log.
However... when I then click on the Login link on the home page that should prompt me to login again, the home page just flickers and nothing happens. Again no warnings/errors in logs.
I am then forever stuck on the home page.
The second method I tried involves using a backing bean, which I have registered in my adfc-config.xml file with 'request' scope.
On my welcome.jspx:
<af:commandLink text="Logout" id="gl1" action="#{loginBean.doLogout}"/>My link calls the doLogout() method in my backing bean containing:
  import java.io.IOException;
  import javax.faces.context.ExternalContext;
  import javax.faces.context.FacesContext;
  import javax.servlet.http.HttpServletResponse;
  import javax.servlet.http.HttpSession;
  public String doLogout() throws IOException {
    ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
    HttpServletResponse response = (HttpServletResponse)ectx.getResponse();
    HttpSession session = (HttpSession)ectx.getSession(false);
    session.invalidate();
    response.sendRedirect("home.jspx");
    return null;
  }The application DOES redirect me to home.jspx however I get the following error in the logs:
java.lang.IllegalStateException: Cannot forward a response that is already committed
     at weblogic.servlet.internal.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:122)
     at com.sun.faces.context.ExternalContextImpl.dispatch(ExternalContextImpl.java:410)
     at org.apache.myfaces.trinidad.context.ExternalContextDecorator.dispatch(ExternalContextDecorator.java:44)
     at org.apache.myfaces.trinidad.context.ExternalContextDecorator.dispatch(ExternalContextDecorator.java:44)
     at org.apache.myfaces.trinidad.context.ExternalContextDecorator.dispatch(ExternalContextDecorator.java:44)
     Truncated. see log file for complete stacktrace
AND...the same thing happens as with my other attempt, I am stuck on the home page and clicking the login link just flickers the page.
I feel as if I have followed the Fusion Developer's Guide on how to do this down to a T, however I am not getting a working solution.
Any help would be greatly appreciated.
Thankyou,
Matthew.

Answer 1

I have had a few developments...
I found out that after I have been redirected to home.jspx where my Login link just refreshes the page on click... if I instead manually change the end of the URL in the address bar of my browser to /welcome.jspx, then it works...I get prompted to login again. This proves that I am actually being logged out, if I change the URL manually before I click my logout link (calling the logout method) it does not request for me to log in again.
So it seems that the problem lies with my action reference on my login link.
<af:commandLink text="Enter" id="cl1" action="login" inlineStyle="font-size:small;"/>the action 'login' works UNTIL i logout, then it does not work anymore...
Second to this, I tried a different LOGIN method using:
<af:commandNavigationItem text="Login" id="cni1" inlineStyle="font-size:small; text-decoration:none;"
                                        destination="/adfAuthentication?success_url=faces/welcome.jspx"/>When using this way to login, I can login, logout AND LOG BACK IN successfully...
However as soon as I click on ANY component that uses a control flow case it just refreshes the page.
re-proving from the first example that the problem is that control flow cases stop working after a logout.
so basically, once I log out and then try to navigate a control flow case, the page I am on just refreshes and the navigation does not occur.
Surely someone now can elaborate on this.
Regards,
Matthew.