[
https://issues.apache.org/jira/browse/CXF-7382?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Colm O hEigeartaigh resolved CXF-7382.
--------------------------------------
Resolution: Fixed
> Don't cache SecurityTokens per-endpoint when the STSClient is used as an
> intermediary
> -------------------------------------------------------------------------------------
>
> Key: CXF-7382
> URL: https://issues.apache.org/jira/browse/CXF-7382
> Project: CXF
> Issue Type: Improvement
> Reporter: Colm O hEigeartaigh
> Assignee: Colm O hEigeartaigh
> Fix For: 3.2.0, 3.1.12
>
>
> If the STSClient is used as an intermediary with delegation
> (OnBehalfOf/ActAs) you must set the property
> "security.cache.issued.token.in.endpoint" to "false". Otherwise it just
> retrieves the first cached token from the endpoint. However, it would be
> better to disable caching tokens per-endpoint if we have a delegation token
> by default, as it is less of a security risk.
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
