Completed:: Security issue in Token Based Authentication
Updates the security.properties content related to JWT
Refers to the last up to date external-server-test-example.patch at
Makes demo-trunk.ofbiz.apache.org default external-server-name so that anybody
can try the feature from own machine. The use-external-server=Y was already set
@@ -132,12 +132,11 @@ default.error.response.view=view:viewBlocked
# -- If false, then no externalLoginKey parameters will be added to cross-webapp urls
security.login.externalLoginKey.enabled=true
-### To have this working, an example of the change needed on the source server is available in OFBIZ-9833-external-server-test-example.patch
-### With this example, the external-server-query must be /catalog/control/
+### To have this working, an example of the change needed on the source server is available in OFBIZ-10206-external-server-test-example.patch
# -- If true, then it's possible to connect to another webapp on another server w/o signing in
# -- This needs to be changed on both the source server and the target server
use-external-server=Y
# -- Name of the external server (DNS) ex: demo-trunk.ofbiz.apache.org where the port is not needed, or localhost:8443 (default) for local tests (not using the same webapp)
-external-server-name=localhost:8443
+external-server-name=demo-trunk.ofbiz.apache.org
# -- Time To Live of the token send to the external server in seconds
external-server-token-duration=30
