Here is how to log out a user (invalidate their java web session) assuming you have a Flex 2 front end with a Java back end. Also assuming you are using the standard J2EE JAAS authentication api to protect your web app this will log them out of the software. Create a back end java function with the following code in it:

flex.messaging.FlexContext.getHttpRequest().getSession().invalidate();

Call this from the flex front end through a web service or through flash remoting.
Once you have invalidated the java session you should redirect the user back to the login page or to some other start page for your site. If you do not then the flex app will fail when trying to retreive data through the flex data services servlet to your java web app. So, place the following ActionScript code in the onResult handler of the flex method that called the service:

flash.net.navigateToURL(”.”)

Be careful when naming the method on the java back end. For example, you cannot use the method name “logout” because mx.rpc.AbstractService already has a method named logout() and you would be calling the Adobe class’s function rather than your java function. I have an associate that named his method logout() and it took us almost 2 hours to find out what was actually happening. We found that the mx.rpc.remoting.RemoteObject’s logout() method was being called rather than the one we wrote. And this is the error message we kept getting:

13:54:28,843 INFO [STDOUT:152] [Flex] [ERROR] Error handling message: flex.messaging.security.SecurityException: External login command required. Please check your security configuration.
incomingMessage: Flex Message (flex.messaging.messages.CommandMessage)
operation = logout
messageRefType = flex.messaging.messages.AuthenticationMessage
clientId = 89793734-5F1D-626C-22C6-3FFBE22775BC
correlationId =
destination =
messageId = 3AC1A57B-A8AE-D338-4C9D-B3306BB03966
timestamp = 1188417268687
timeToLive = 0
body = {}
errorReply: Flex Message (flex.messaging.messages.ErrorMessage)
clientId = null
correlationId = 3AC1A57B-A8AE-D338-4C9D-B3306BB03966
destination =
messageId = 897938B1-3B0E-8BFF-B43E-8096767736F8
timestamp = 1188417268843
timeToLive = 0
body = null
code = Server.Authorization
message = External login command required. Please check your security configuration.
details = null
rootCause = null
body = null
extendedData = null