WildFly login module called for every http request

Question

I have written a custom login module for WildFly 10 which works. But the validatePassword method gets called for every http request , even after a successful login. How do I prevent these extra login validations?

package my.company.security;

import java.security.acl.Group;
import java.util.List;

import javax.naming.InitialContext;
import javax.naming.NamingException;
import javax.security.auth.login.LoginException;

import org.jboss.security.SimpleGroup;
import org.jboss.security.SimplePrincipal;
import org.jboss.security.auth.spi.UsernamePasswordLoginModule;

import my.company.myapp.boundary.UserManager;

public class MyLoginModule extends UsernamePasswordLoginModule {

    private static final String ROLES_GROUP_NAME = "Roles";

    @Override
    protected String getUsersPassword() throws LoginException {
        return "";
    }

    @Override
    protected boolean validatePassword(final String inputPassword, final String expectedPassword) {
        boolean login = false;
        try {
            UserManager userManager = getUserManager();
            System.out.println("call");
            login = userManager.verifyLogin(getUsername(), inputPassword);
        } catch (LoginException e) {
            setValidateError(e);
        }

        return login;
    }

    @Override
    protected Group[] getRoleSets() throws LoginException {
        UserManager userManager = getUserManager();
        try {
            List<String> roles = userManager.getUserRoleNames(getUsername());
            SimpleGroup group = new SimpleGroup(ROLES_GROUP_NAME);

            for (String role : roles) {
                group.addMember(new SimplePrincipal(role));
            }
            return new Group[] { group };
        } catch (RuntimeException e) {
            throw new LoginException(e.getMessage());
        }
    }

    private UserManager getUserManager() throws LoginException {
        UserManager userManager;
        try {
            userManager = (UserManager) new InitialContext().lookup("java:global/myapp/UserManager");
        } catch (NamingException e) {
            throw new LoginException(e.getMessage());
        }
        return userManager;
    }

}

Answer 1

For JBoss / WildFly there are two options for caching in login modules default and infinispan. If there is no cache specified then there will be no caching. For example in the default standalone.xml file the other security domain is defined as:

 <security-domain name="other" cache-type="default">