The configuration you've shared is OK for your setup. You could change some settings to better fit your scenario, but the one you have is actually OK.
security.server.hostname is empty, Aggregate detects a valid IP address automatically when starting, which works in most situations.
You could try to set a specific value in
security.server.hostname, though. That would prevent issues in case Aggregate has detected an IP address different than the one users are using to access it, which would explain why changing passwords fails.
In order to do that, you can follow these steps:
- Stop Tomcat
- Create a backup of the whole directory where Aggregate is deployed
WEB-INF/lib/ODKAggregate-settings.jar << this is important
WEB-INF/classes/security.properties and set
security.server.hostname with the IP address or hostname that the users will be using to access Aggregate
- Start Tomcat