Problem with authorization after logout (adfc issue?)

Question

Hi,
I have an application with implemented ADF Security, and navigation case login.jspx -> home defined in adfc-config.xml ("home" is the name of view activity, page is home.jspx),
logout is done through redirecting to /adfAuthentication?logout=true&end_url=/faces/login.jspx.
If I do the login & loguot repeatedly, after 6-7 times (sometimes 2-3, sometimes >10 but definitely happens) after logging in I get authorization exception saying I am not authorized to view home.jspx.
Note that on adfc-config.xml home.jspx is registered as "home", and if I type "home" in URL instead of "home.jspx", I can access the page.
Anybody seen similar behavior?
Thanks,
Pedja

Answer 1

Here is a workaround:
Login button executes this code for authenticating against WLS
    public String login() throws LoginException, IOException {
        String un = (getUsername() == null ? "" : getUsername());
        String pw = (getPassword() == null ? "" : getPassword());
        FacesContext ctx = FacesContext.getCurrentInstance();
        HttpServletRequest request = (HttpServletRequest)ctx.getExternalContext().getRequest();
        CallbackHandler handler = new SimpleCallbackHandler(un, pw.getBytes());
        try {
            ServletAuthentication.login(handler, request);
        } catch (FailedLoginException fle) {
            FacesMessage msg = new FacesMessage(FacesMessage.SEVERITY_ERROR, " ", "Login error!"));
            ctx.addMessage(null, msg);
            return null;
        return "success";
    }If I call response.redirect("/faces/home") instead of returning a navigation action, the error can no longer be reproduced.
So, is this ADFc or ADFSecurity issue (adfAuthentication servlet gets confused)?
By the way, I'm using WLS's Default Authenticator, but this behavior has reproduced on few other applications, some of them use SQLAuthenticator, so this is not a WLS issue.
Pedja