配置内容分析如下
# -- 定义上下文使用者 --
security.context =default
# -- 定义密码限制长度最小值 --
password.length.min =5
# -- 登录失败的最大次数 --
max.failed.logins =3
# -- 保存密码修改记录的最大条数, 被保存在 UserLoginPasswordHistory 表的记录
# 可防止使用过的密码再次使用, 0 表示不保存历史记录 --
password.change.history.limit =0
# -- 多长时间后禁用该用户, 若为0则不禁用 --
login.disable.minutes =5
# -- 禁用全局注销 --
login.disable.global.logout =false
# -- 保存每次登录的历史记录; 保存服务访问权限的校验记录; 保存不正确的登陆密码; --
store.login.history =true
store.login.history.on.service.auth =false
store.login.history.incorrect.password =true
# -- 是否进行密码加密 --
password.encrypt =true
# -- set requirePasswordChange to true, after emailPassword --
password.email_password.require_password_change =true
# -- 设置密码加密方式 java.security.MessageDigest.getInstance() --
# -- options may include: SHA, MD5, etc
password.encrypt.hash.type =SHA
# -- this is helpful to recover old accounts or to be able to login at all sometimes --
# -- SHOULD GENERALLY NOT BE TRUE FOR PRODUCTION SITES,
# but is useful for interim periods when going to password encryption --
password.accept.encrypted.and.plain =false
# -- 登录用户名和密码进行全小写处理开关 --
username.lowercase =false
password.lowercase =false
# -- 使用 LDAP 进行权限认证 --
security.ldap.enable =false
# -- LDAP登录失败, 是否重新登录 --
security.ldap.fail.login =false
# -- 是否允许 X509 证书登录
security.login.cert.allow =true
# -- HTTP 报文头 基础ID (for integrations; uncomment to enable)
#security.login.http.header =REMOTE_USER
# -- HttpServletRequest.getRemoteUser() based ID (for integration; uncomment to enable)
# Use for external authentication solutions like CAS which overload the getRemoteUser method.
# security.login.http.servlet.remoteuserlogin.allow =true
# -- pattern for the userlogin id in CN section of certificate
security.login.cert.pattern =^(\w*\s?\w*)\W*.*$
# -- 邮箱验证信息过期时间默认为 x 小时(EmailAdressVerification)
email_verification.expire.hours =48
# -- Name of the protect-view preprocessor method (this should not change, but in case...)
protect-view.preprocessor =java.org.ofbiz.webapp.control.ProtectViewWorker.checkProtectedView
# -- Name of the default error response view for protected views
# ("none:" will be rendered as a blank page, see RequestHandler.java)
# default.error.response.view =none:
default.error.response.view =view:viewBlocked