[
https://issues.apache.org/jira/browse/OFBIZ-10047?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16294055#comment-16294055
]
Michael Brohl commented on OFBIZ-10047:
---------------------------------------
Hi James, Jacques,
thanks you for your efforts on this!
I did a brief review and found the following points to change and/or discuss:
1. The retrieval functionality for the configuration parameter
"security.login.tomcat.sso" is using a default of "true" when it is not found.
I'd propose to set this to false because it is a new feature and the old
behaviour should be the default until the new mechanism is field tested enough.
2. there is a possible NullPointerException in OFBizRealm#getPassword when no
userLogin is found
3. OFBizRealm#getName() overrides a deprecated method.
4. service userLogin has a new mandatory parameter request. I'm not sure if it
is a good idea to have a dependency on a request in a service? It will at least
break the possibility to use it in another context where you do not have a
request.
It is also not needed for other calls in ICalWorker.java and
XmlRpcEventHandler.java so it should at least be optional.
5. Question: Is there any possible drawback when using this feature in a load
balanced/clustered environment. Is it tested in this case?
6. Question: does this interfere with other SSO solutions we currently have in
plugins/ldap?
Maybe we should also check these and see if these solutions can be
harmonized?
7. Someone should check this solution from an architectural view.
I appreciate the efforts but I am also in doubt if we should put this feature
into the new release. It's very fresh, deals with a very central functionality
and should be field tested more.
What do you think?
> Tomcat SSO
> ----------
>
> Key: OFBIZ-10047
> URL: https://issues.apache.org/jira/browse/OFBIZ-10047
> Project: OFBiz
> Issue Type: Improvement
> Components: framework
> Affects Versions: Trunk
> Reporter: James Yong
> Assignee: James Yong
> Priority: Minor
> Attachments: OFBIZ-10047.patch, OFBIZ-10047.patch, OFBIZ-10047.patch,
> OFBIZ-10047.patch
>
>
> Proposing Tomcat SSO to be used in OFBiz to improve on Single-Sign-On.
> This aim to fix the issues mentioned in OFBIZ-6963, OFBIZ-6994.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
