delete-cookies don't delete LtpaToken

[fsteccanella]

Hi there,
I'm developing a web application that use a PreAuthenticationFilter for using IBM LtpaToken for loggin in..
I'd like to delete the token when the user logout, but I can't...

My logout filter is configured like this:

<security:logout logout-url="/auth/logout" invalidate-session="true" logout-success-url="/auth/login"  delete-cookies="LtpaToken"/>

how can i do?!
Thanks in advance

[jamescox]

I don't think you want to just delete the ltpa token. Websphere is managing this cookie, you should not be. I would guess that the App Server is calling set-cookie after you try to delete it, but you would have to look at the responses in Firebug to confirm this.

LTPA is for SSO. Do you have multiple web applications? If not, consider something simpler. If you do have multiple web apps, you need to understand that clearing the LTPA token ends your SSO session, which is not equivalent to your HTTP Session. (You could have many httpsessions, but only one SSO session). Ending your SSO Session should result in you becoming unauthenticated in ALL of your web applications. If this is truly what you want, you will need to read some IBM documentation. on how to do this.

Also, you can probably use J2eePreAuthenticatedProcessingFilter directly as Websphere should be injecting the userPrincipal.

[fsteccanella]

Thanks for the anwser james..
I too thought it was the app server, but it doesn't seems to me...
However i have to delete the cookie, because, as PreAuthFilter, it is fired on every secured pattern,so i can't fully log out!!!
I don't mind if i destroy the sso session (not completely true, because there is also the LtpaToken2 that i ignore in spring..)

[Rob Winch]

Does it happen in every browser? Can you use something like Tamper Data to see if it is trying to delete the cookie properly?

[fsteccanella]

Yes, in every browser...
I've checked with cookie manager the creation date and it doesn't change, so the cookie isn't deleted and recreated...

Can the problem occurs because of the domain?!
LtpaToken has domain .company.com...my app instead create it's remember-me cookie under app.company.com...
Maybe I can't delete domain-wide cookie?!