title: (Grails plugin) Spring Security Single Signout
body: <p>I'm trying to understand how Spring Security handles Single Signout.  I'm using a CAS server with multiple Grails apps.  Here is my scenario:</p>
  
  <p>App #1 &amp; Login</p>
  
  <ol>
  <li>User navigates to Grails app #1.  </li>
  <li>app #1 has no authentication data for the User, and checks the CAS server.  The CAS server has no cookie data for the User, so CAS prompts the User to login.</li>
  <li>User logs in to CAS and gets a valid ticket.  User is redirected back to the app #1 URL from step 1.</li>
  <li>In the first request after authentication, app #1 loads the CAS ticket into its SecurityContextHolder.  Subsequent requests use the ticket data to verify the user is authenticated.</li>
  </ol>
  
  <p>App #2 &amp; Logout</p>
  
  <ol>
  <li>User navigates to Grails app #2.</li>
  <li>app #2 has no authentication data for the User, and checks the CAS server.  The CAS server has cookie data for the User and uses this data to authenticate the User.</li>
  <li>In the first request after authentication, app #2 loads the CAS ticket into its SecurityContextHolder.  Subsequent requests use the ticket data to verify the user is authenticated.</li>
  </ol>
  
  <p>Logout</p>
  
  <ol>
  <li>User logs out of app #2 by hitting app #2's logout page.  app #2 no longer has User data stored in SecurityContextHolder.  </li>
  <li>User is redirected to the CAS server logout page.  CAS no longer has a valid ticket for the User.</li>
  <li>Subsequent (protected) requests to app #2 will redirect the User to the CAS login page.</li>
  <li><strong>Because app #1 still has CAS ticket data in its SecurityContextHolder, subsequent (protected) requests to app #1 will not redirect the user to login.  The context must be cleared or expire somehow.</strong></li>
  </ol>
  
  <p><strong>How am I supposed to keep the User from accessing protected URLs in app #1 ? Is there an expiration date I can set for the SecurityContextHolder ?</strong></p>