I think you need to invalidate the HttpSession if you are using a web application.
If you are using desktop application you can call the JAAS methods to logout, but I don't rementer how do this. You can see the docs for this.
Regards
[Message sent by forum member 'xflyer' ]
http://forums.java.net/jive/thread.jspa?messageID=371542