I'm tring to implement a logout procedure for my web app;
this procedure should be activate from ajax commandLink and should destroy backingbeans, invalidate session and (important) redirect to login page (jsp).
The most common way to force a logout is to use the session.invalidate() method, which destroys all session objects, including the container-managed User Principal object. New developments in JEE also provide a specific logout method if your environment is capable of using it.
Redirecting to a login page is automatic when you use the J2EE standard security services. If you invented your own, you're on your own. You'll have to develop, debug, and maintain your own mechanisms. And deal with the consequences when your "secure" software turns out not to be secure.
An IDE is no substitute for an Intelligent Developer.