wso2 api manager 1.7 /oauth2/userinfo api throws NullPointerException

Question

We are evaluating wso2 api manager 1.7 and have a use case to fetch user info from authorization token. We tried using /oauth2/userinfo api, but it throws NPE. Please find more details below:

"curl -k -H "Authorization: Bearer 5e485cb7dbf5118d3b2d99e6f75dee" apim_url/oauth2/userinfo?schema=openid"

---

java.lang.RuntimeException: org.apache.cxf.interceptor.Fault
        org.apache.cxf.interceptor.AbstractFaultChainInitiatorObserver.onMessage(AbstractFaultChainInitiatorObserver.java:116)
        org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:331)
        org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
        org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:239)
        org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:223)
        org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:203)
        org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:137)
        org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:159)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:286)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.doGet(AbstractHTTPServlet.java:211)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:735)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:262)
</pre></p><p><b>root cause</b> <pre>org.apache.cxf.interceptor.Fault
        org.apache.cxf.service.invoker.AbstractInvoker.createFault(AbstractInvoker.java:162)
        org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:128)
        org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:194)
        org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:100)
        org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:57)
        org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:93)
        org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:271)
        org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
        org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:239)
        org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:223)
        org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:203)
        org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:137)
        org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:159)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:286)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.doGet(AbstractHTTPServlet.java:211)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:735)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:262)
</pre></p><p><b>root cause</b> <pre>java.lang.NullPointerException
        org.wso2.carbon.identity.oauth2.validators.DefaultOAuth2TokenValidator.validateScope(DefaultOAuth2TokenValidator.java:52)
        org.wso2.carbon.identity.oauth2.validators.TokenValidationHandler.findOAuthConsumerIfTokenIsValid(TokenValidationHandler.java:246)
        org.wso2.carbon.identity.oauth2.validators.TokenValidationHandler.validate(TokenValidationHandler.java:129)
        org.wso2.carbon.identity.oauth2.OAuth2TokenValidationService.validate(OAuth2TokenValidationService.java:47)
        org.wso2.carbon.identity.oauth.endpoint.user.impl.UserInfoISAccessTokenValidator.validateToken(UserInfoISAccessTokenValidator.java:45)
        org.wso2.carbon.identity.oauth.endpoint.user.OpenIDConnectUserEndpoint.getUserClaims(OpenIDConnectUserEndpoint.java:57)
        sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        java.lang.reflect.Method.invoke(Method.java:606)
        org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:180)
        org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:96)
        org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:194)
        org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:100)
        org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:57)
        org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:93)
        org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:271)
        org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
        org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:239)
        org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:223)
        org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:203)
        org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:137)
        org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:159)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:286)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.doGet(AbstractHTTPServlet.java:211)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:735)
        org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:262)

Answer 1

seeing the exception root at "DefaultOAuth2TokenValidator.validateScope", try to add a scope=openid at the request

example:

https://wso2_is_host:9443/oauth2/authorize?response_type=token&client_id=hkJUZBbWYHPzS8FbRtn9PwwuFL4b&redirect_uri=http%3A%2F%2Fapp_host%3A8080%2Fwpapp%2Fcallback.jsp&scope=openid

Good luck Gabriel