Webapp remembers last system login and displays to anyone accessing the site - jsf-2

Question

Here is the scenario that I am noticing.
Jason logs in with username Jason
Tim logs in with username Tim
Jason logs out and gets redirected to login page
Jason sees username Tim in the username field
I am not understanding how/why Glassfish is doing this.
The project is deployed on Glassfish 3.1.2, running LDAP auth realm. The app is configured to use this realm to authenticate against.
The front end is using PrimeFaces for the login/logout functionality.
--EDIT--
Here is my login page
<h:form id="login-form" class="form-login">
<p:growl id="msg" showDetail="true" life="3000" />
<h4 class="form-login-heading">
Enter Login Information
</h4>
<br/>
<span class="error">
<h:messages errorStyle="color: red" infoStyle="color: green" globalOnly="true"/>
</span>
<div>
<h:panelGroup rendered="#{!authenticationController.authenticated}">
<div class="form-group">
<label for="username">Username</label>
<h:inputText id="username" styleClass="form-control" placeholder="Enter username" value="#{authenticationController.username}"/>
</div>
<div class="form-group">
<label for="password">Password</label>
<h:inputSecret id="password" styleClass="form-control" placeholder="Enter passowrd" value="#{authenticationController.password}" />
</div>
<h:commandButton id="login" styleClass="btn btn-primary pull-right lock-image" action="#{authenticationController.login}" value="Login">
</h:commandButton>
</h:panelGroup>
<br/>
</div>
Here is the login controller
#ManagedBean
#Named("authenticationController")
#SessionScoped
public class AuthenticationController implements Serializable {
#Inject
private AuthenticationOperation authOp;
private String username = null;
private User user = null;
private boolean authenticated = false;
private HttpSession session = null;
private String userAgent = null;
/**
* Creates a new instance of AuthenticationController
*/
public AuthenticationController() {
}
#PostConstruct
public void init(){
getUser();
}
public HttpSession getSession() {
// if(session == null){
FacesContext context = FacesContext.getCurrentInstance();
HttpServletRequest request = (HttpServletRequest) context.getExternalContext().getRequest();
session = request.getSession();
return session;
}
/**
* #return the username
*/
public String getUsername() {
this.username = getUser().getUsername();
return this.username;
}
/**
* #param username the username to set
*/
public void setUsername(String username) {
this.username = username;
getUser().setUsername(username);
}
/**
* #return the password
*/
public String getPassword() {
return authOp.getPassword();
}
/**
* #param password the password to set
*/
public void setPassword(String password) {
authOp.setPassword(password);
}
public User getUser() {
if (this.user == null) {
user = new User();
setUser(authOp.getUser());
}
return user;
}
public void setUser(User user) {
this.user = user;
}
/**
* This method is called from the view.
*
* On successful login the view will be forwarded to the main index page. Otherwise,
* The user will be prompted to login again.
* #return The view return either the index page or bad login.
*/
public String login() {
authOp.setUser(getUser());
if (authOp.authenticate()) {
this.authenticated = true;
setUser(authOp.getUser());
return "index?faces-redirect=true";
} else {
this.authenticated = false;
setUser(null);
return "BAD_LOGIN";
}
}
/**
* Logs a user out - essentially invalidating the user's http session and then
* forwarding the view on to the login page.
* #throws IOException
*/
public void logout() throws IOException{
user = null;
this.authenticated = false;
FacesContext facesContext = FacesContext.getCurrentInstance();
ExternalContext externalContext = facesContext.getExternalContext();
externalContext.invalidateSession();
externalContext.redirect(externalContext.getRequestContextPath() + "/users/login.xhtml");
}
/**
* A simple check to see if the current user has been authenticated.
* #return the authenticated
*/
public boolean isAuthenticated() {
try {
// Allows subsequent requests to obtain authentication status from the session state
boolean auth = (Boolean) getSession().getAttribute("authenticated");
if (auth) {
this.authenticated = true;
} else {
authenticated = false;
}
} catch (Exception e) {
this.authenticated = false;
}
return authenticated;
}
public void setAuthenticated(boolean authenticated) {
this.authenticated = authenticated;
}
}

Answer 1

I believe your authOp variable is likely application scoped. This would cause a user to see a previous users' name because of this section of code:
public User getUser() {
if (this.user == null) {
user = new User();
setUser(authOp.getUser());
}
return user;
}