SSO header change for RESTful services

In Apache Syncope 2.0.3, SSO support was added (

curl -H "X-Syncope-Token: eyJ0e..." http://localhost:8080/syncope/rest/users/self

From Syncope 2.0.4 onwards (

curl -H "Authorization: Bearer eyJ0e..." http://localhost:8080/syncope/rest/users/self

JWS signing key reference

In Apache Syncope 2.0.3, the default signing JWS key was referenced in securityContext.xml as follows: "${jwsKey}.bytes". However, this was incorrect and results in the key value with ".bytes" appended to it. In Syncope 2.0.4, the following value should be used instead "#{jwsKey.getBytes()}".

Default key and password checking

In Apache Syncope 2.0.4, a warning is logged if the default JWS key is used to either create/update an access token, or is used to invoke on a RESTful service. A similar warning is logged if the default anonymous key is used to invoke on a RESTful service.

...

Before starting

Due to the changes occurred in JWT management, execute the SQL query below on your internal storage:

DELETE FROM AccessToken;