Shiro seems to cache authentication information in web application. When I try to lock the user in database during his session (set locked = true), he continues to work and no authentication code (*doGetAuthenticationInfo*) is called. Lock is only applied when user logouts and try to login again.

It is strange as Shiro's caching should be disabled by default.

How could I lock user during his activity not waiting for him to logout in Shiro? Maybe I am missing some concept?