Hi,
as I mentioned, the LogoutFilter as it is implemented in Sprin Secutity will not detect a logout by anything else than a url. So I imeplemented my own one that is able to detect the logout command issued by ChannelSet.logout(). Using this implementation my event-dispatcher gets called as expected.
Code:
package de.cware.cweb.webapp.security;
import org.springframework.security.Authentication;
import org.springframework.security.context.SecurityContextHolder;
import org.springframework.security.ui.FilterChainOrder;
import org.springframework.security.ui.SpringSecurityFilter;
import org.springframework.security.ui.logout.LogoutHandler;
import org.springframework.util.Assert;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/**
* Logs a principal out.
* <p>
* Polls a series of {@link org.springframework.security.ui.logout.LogoutHandler}s. The handlers should be specified in the order they are required.
* Generally you will want to call logout handlers <code>TokenBasedRememberMeServices</code> and
* <code>SecurityContextLogoutHandler</code> (in that order).
* </p>
* This version principally does the same as the original LogoutFilter but it detects a logout
* not by analysing the request-url but by inspecting the ContextHolder content. It allows detection
* of system-logouts performed by setting the ContextHolder content to null.
*
* @author Christofer Dutz
*/
public class LogoutFilter extends SpringSecurityFilter {
//~ Instance fields ================================================================================================
private LogoutHandler[] handlers;
//~ Constructors ===================================================================================================
public LogoutFilter(LogoutHandler[] handlers) {
Assert.notEmpty(handlers, "LogoutHandlers are required");
this.handlers = handlers;
}
//~ Methods ========================================================================================================
public void doFilterHttp(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException,
ServletException {
final Authentication auth = SecurityContextHolder.getContext().getAuthentication();
final boolean wasLoggedOut = auth == null;
chain.doFilter(request, response);
final boolean isLoggedOut = SecurityContextHolder.getContext().getAuthentication() == null;
if(isLoggedOut && !wasLoggedOut) {
if (logger.isDebugEnabled()) {
logger.debug("Logging out user '" + auth + "' and redirecting to logout page");
}
for (int i = 0; i < handlers.length; i++) {
handlers[i].logout(request, response, auth);
}
}
}
public int getOrder() {
return FilterChainOrder.LOGOUT_FILTER;
}
}
Make SpringSecurity actually logout a user on ChannelSet.logout()
Reply With Quote
Found the Reason ... but how to fix?
Custom LogoutFilter
). 
Config
I could extend GenericFilterBean but I think there is a 
