要使用来自WSO2 ESB的令牌访问已发布的WSO2 API管理器API，无法从WSO2 API管理器获取访问令牌

Question

I have written WSo2 ESB Proxy service where the proxy service calls the http service which is published in WSo2 API Manager. Because the API's are published in WSo2 API Manager to access the API we need to generate the token using a consumer key and a secret key. I manually logged in to wso2 api manager, I subscribed to the published API and using my consumer key and secret key I have generated the token and use that token while calling the API from WSo2 ESB. In the http request header I have set those token and from WSo2 ESB able to invoke the API getting response from the API, but this token will expire after 60 minutes so I need to generate the token by calling

https://api-dev.xyz.org/token
POST 
Authorization: Basic Zzc5enNRN0xLM0hOcHU2N0g2a2R1dkx6WGRrYTpJSEF1NWZUdW5FdG9BV0xfa1hCcUdvRGVPWmdh

Payload
grant_type=client_credentials

I will get response as

response

{
   scope: "default"
   token_type: "bearer"
   expires_in: 3171
   access_token: "db995950f960b4c67162e2d92a1117a5"
}

curl command to get the token:-

curl -k -d "grant_type=client_credentials" -H "Authorization: Basic Rnl5YmwwNVhacGhBb01mVE5VNE91ZkxfblRVYTpUSmt6QUJFbzZaN3FkNkE1cHE3V3JSd2ZNaHNh, Content-Type: application/x-www-form-urlencoded" https://api-dev.xyz.org:8243/token

In WSo2 ESB Proxy Service i have coded similar to curl command to get the token,

<property xmlns:ns="http://org.apache.synapse/xsd"  

           name="Authorization"  

           expression="fn:concat('Basic ',OUU0Zk05eU81R0VCcV9odUxBYW15SzRCaEZFYToxVmVnbHl5OFBhQTkyMFRxbEUySnduWHlTbThh)"  

           scope="transport"/>         

         <payloadFactory media-type="json">

<format>

{

"grant_type":"client_credentials"

}

</format>

</payloadFactory>

<property name="messageType" value="application/x-www-form-urlencoded" scope="axis2"/>

          <send>

            <endpoint>
<http method="get" uri-template="https://api-dev.xyz.org:8243/token"/>

           <property name="grant_type" value="client_credentials"/>

        </endpoint>

     </send>

I'm getting response as

TargetHandler I/O error: Host name verification failed for host : 172.18.65.251
javax.net.ssl.SSLException: Host name verification failed for host : 172.18.65.251
    at org.apache.synapse.transport.http.conn.ClientSSLSetupHandler.verify(ClientSSLSetupHandler.java:162)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:291)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:391)
    at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:119)
    at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:159)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:338)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:316)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:277)
    at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:105)
    at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:586)
    at java.lang.Thread.run(Thread.java:745)

Any idea how to resolve this issue ?

Answer 1

This is a certificate validation issue. This happens when the server can't find a corresponding certificate for the host. You can try one of the following methods to fix this:

1. Import the public certificate of the backend (APIM in this case) to the client-truststore of the ESB. More info on this here . For production use, this is the recommended approach.
2. Or else, set 'HostnameVerifier' value to 'AllowAll' in the https transport sender configuration of '/reposotory/conf/axis2/axis2.xml'

eg:

<transportSender name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpSSLSender">
    ....
    <parameter name="HostnameVerifier">AllowAll</parameter>
    ....
</transportSender>