[
https://issues.apache.org/jira/browse/OFBIZ-10047?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16294114#comment-16294114 ]
Jacques Le Roux commented on OFBIZ-10047:
-----------------------------------------
Hi Michael,
Did not see your comment before posting mine
# I think that we should rather use true by default and deprecate the externalLoginKey stuff. This will be only in trunk and soon coming R17. So we will have one year to test it before release. Without people using it much it will stay in the background and we will not benefit of all those tests, notably in demos
# Right
# Indeed. I read ^1^ that we can use Class.getSimpleName() instead.
# Right
# I did not try. It's a cookie thing ^2^ so it should work if you use ClusterSingleSignOn ^3^
# For me that's different. I see it only as a replacement of externalLoginKey and it works only on one virtual host ^2^. While other solutions need an external server to work, even if it can be on the same machine. That's at least the case for what I know: SAML and Oauth 2, which are centralised solutions. LDAP should be the same (I don't know much about it). But I agree: better to check, again we have a year for that. If we don't now we will never. And then my prediction is it will not be used OOTB.
# Not someone, as much as possible persons, thanks for your attention :)
Like I said above, we need to embedd this solution and use it right now in order to flush out all issues. And with your comment we have now some more things to check!
^1^ String org.apache.catalina.realm.RealmBase.getName()
@Deprecated
Deprecated. This will be removed in Tomcat 9 onwards. Use Class.getSimpleName() instead.
Returns:a short name for this Realm implementation, for use in log messages.
^2^
https://tomcat.apache.org/tomcat-8.5-doc/config/host.html#Single_Sign_On. Though I have still to read
https://tomcat.apache.org/tomcat-8.5-doc/realm-howto.html to better understand how this really works, and maybe answer to my question on "password stored in clear"
^3^
https://tomcat.apache.org/tomcat-8.5-doc/config/cluster-valve.html#org.apache.catalina.ha.authenticator.ClusterSingleSignOn> Tomcat SSO
> ----------
>
> Key: OFBIZ-10047
> URL:
https://issues.apache.org/jira/browse/OFBIZ-10047> Project: OFBiz
> Issue Type: Improvement
> Components: framework
> Affects Versions: Trunk
> Reporter: James Yong
> Assignee: James Yong
> Priority: Minor
> Attachments: OFBIZ-10047.patch, OFBIZ-10047.patch, OFBIZ-10047.patch, OFBIZ-10047.patch
>
>
> Proposing Tomcat SSO to be used in OFBiz to improve on Single-Sign-On.
> This aim to fix the issues mentioned in OFBIZ-6963, OFBIZ-6994.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
Locked
