Just to check: you use form based kind not basic authentication?
Correct, form based authentication, with a simple login form that submits to j_security_check.
I thought it might have been my custom filter servlet that was interfering, but after commenting that out the same behavior remained. With the filter still enabled, in the debugger I saw that the errors were generated after the logout method (invoked by a link) returned, and before the filter was invoked as part of rendering the next page request.
I can try creating a brand new application that wasn't migrated from 11g and enable ADF Security and see if the same thing happens.
Yes, you should do that. Build it based on the HR shema. If it turns out to show the same behavior we have a test case to look into.
I made a fresh ADF 12c application with just a ViewController project (and an empty Model project) with two JSF pages that each render a bounded taskflow as a region in the page.
I ran through the "Configure ADF Security" wizard, as outlined in the documentation, and the same problem remained. The error message didn't happen as many times each logout, but it was still generated at least once each time.
try to invalidate the session manually
ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
This excludes the authentication servlet from the equation as a source of error
I gave that idea a try, and it was the same result as the very similar manual logout code given in the documentation I tried earlier: http://docs.oracle.com/middleware/1212/adf/ADFFD/adding_security.htm#ADFFD21669
The logout happens successfully, but that error message shows up in the logs at least once. Whenever I do a logout without going through the authentication servlet, the error is always logged exactly 1 time fewer. In my application I migrated from 11gR2 to 12c, the error would happen 4 times (5 through the servlet), and in the fresh sample 12c app I made earlier this week, it happens 1 time (2 through the servlet).
I should also add that all of this testing has just been done in the integrated weblogic 12c server that comes with JDeveloper 12c.