How to remove Audience Manager claims from the ADF

Question

I have a (Java) web application which uses the Audience Manager ADF cartridge. This works fine by (as documented) setting the taf:claim:audiencemanager:contact:id session attribute on login, and I see my contact details populated in the ADF. I have implemented a logout, where I clear this session attribute:

request.getSession().removeAttribute("taf:claim:audiencemanager:contact:id");

However on subsequent requests I still see the ADF populated with the previously logged in user's details.

How can I ensure that these are no longer added after the user has logged out?

If I log in with another user, the ADF is populated with the new user's details, so it does seem possible to clear the ADF state, however simply doing this:

request.getSession().setAttribute("taf:claim:audiencemanager:contact:id","");

Does not work either.

UPDATE: the only way I found yet to do it is to call

request.getSession().invalidate()

Which seems a bit heavy handed, but will do for now - I would still be interested in alternatives which did not reset the session...

Answer 1

The claimstore is physically stored in the web application's session; although most cartridges (re)set claim values at every request it makes sense they do not remove claim values at every request (if no contact ID claim is set the audience manager cartridge simply does nothing; a removal of existing claims would be relatively expensive here). You will therefore either have to

• remove all taf:claim:audiencemanager:* claims on logout
• recycle the application session on logout

Note that the second is not quite as absurd as it initially sounds; recycling the session on logout is the safest way to guarantee no sensitive information is lingering around in the session after logout (which I'm assuming is the main concern for worrying about claims data remaining available after logout).

Answer 2

The ADF takes any session and request variables and adds them to the ClaimStore. It may be that once you set this session attribute and the ADF copies it to the ClaimStore, it remains there despite the session variable having been removed.

Try removing the user's claims from the store as part of your logout logic. Since the store implements Map, the generic map's remove(key) method should do it.