code: @Override
      public void logout(HttpServletRequest req,
                         HttpServletResponse res,
                         WebAppSecurityConfig webAppSecConfig) throws AuthenticationException {
          Subject subject = null;
          WebRequest webRequest = new WebRequestImpl(req, res, null, null, null, null, webAppSecConfig);
          JaspiRequest jaspiRequest = new JaspiRequest(webRequest, null);
          AuthConfigProvider provider = getAuthConfigProvider(jaspiRequest.getAppContext());
          if (provider != null) {
              try {
                  ServerAuthContext authContext = getServerAuthContext(jaspiRequest, provider);
                  MessageInfo msgInfo = newMessageInfo(jaspiRequest);
                  subject = getSubjectManager().getInvocationSubject();
                  if (subject == null) {
                      subject = new Subject();
                  }
                  if (tc.isDebugEnabled())
                      Tr.debug(tc, "cleanSubject with Jaspi", new Object[] { "authContext=" + authContext, msgInfo });
                  authContext.cleanSubject(msgInfo, subject);
              } catch (AuthException e) {
                  AuthenticationException ex = new AuthenticationException("JASPI cleanSubject failure: " + e);
                  ex.initCause(e);
                  throw ex;
              }
          }
  
          AuthenticationResult authResult = new AuthenticationResult(AuthResult.SUCCESS, subject);
  
          authResult.setAuditCredType(AuditEvent.CRED_TYPE_JASPIC);
          if (provider != null)
              authResult.setAuditAuthConfigProviderName(provider.getClass().toString());
          authResult.setAuditAuthConfigProviderAuthType(getRequestAuthType(jaspiRequest.getHttpServletRequest(), "AUTH_TYPE"));
          authResult.setAuditOutcome(AuditEvent.OUTCOME_SUCCESS);
          Audit.audit(Audit.EventID.SECURITY_API_AUTHN_TERMINATE_01, req, authResult, Integer.valueOf(res.getStatus()));
  
      }
docs: /*
  (non-Javadoc)
  
  @see com.ibm.ws.webcontainer.security.JaspiService#logout(javax.servlet.http.HttpServletRequest,
  javax.servlet.http.HttpServletResponse, com.ibm.ws.webcontainer.security.WebAppSecurityConfig)