[英]WSO2 4.0.0 control-plane as key manager : Error while parsing JWT - Connection refused to localhost:443
我在 private.network 中使用两个 WSO2 Api Manager v4.0.0 节点：
它工作得很好，但我可以在 apim-gw 日志中看到很多错误：
[2023-01-16 16:19:34,010] ERROR {org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl} - Error while parsing JWT org.apache.http.conn.HttpHostConnectException: Connect to localhost:443 [localhost/127.0 .0.1] failed: Connection refused (Connection refused) at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:156) at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376) at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393) at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) at org.apache.http.impl.execchain.ProtocolExec.execute( ProtocolExec.java:186）在 org.apache.http.impl.execchain.RetryExec.execute（重试 Exec.java:89) at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) at org.apache.http.impl .client.CloseableHttpClient.execute(CloseableHttpClient.java:83) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) at org.wso2.carbon.apimgt.impl.utils.JWTUtil.retrieveJWKSConfiguration_aroundBody0(JWTUtil .java:58) at org.wso2.carbon.apimgt.impl.utils.JWTUtil.retrieveJWKSConfiguration(JWTUtil.java:52) at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.retrieveJWKSet_aroundBody22(JWTValidatorImpl.java:231 ）在 org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.retrieveJWKSet（JWTValidatorImpl.java:228）在 org.wso2.carbon。 apimgt.impl.jwt.JWTValidatorImpl.validateSignature_aroundBody8(JWTValidatorImpl.java:145) at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateSignature(JWTValidatorImpl.java:135) at org.wso2.carbon.apimgt.impl. jwt.JWTValidatorImpl.validateToken_aroundBody0(JWTValidatorImpl.java:62) at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateToken(JWTValidatorImpl.java:57) at org.wso2.carbon.apimgt.impl.jwt.JWTValidationServiceImpl. validateJWTToken_aroundBody0(JWTValidationServiceImpl.java:44) at org.wso2.carbon.apimgt.impl.jwt.JWTValidationServiceImpl.validateJWTToken(JWTValidationServiceImpl.java:36) at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator. getJwtValidationInfo_aroundBody18（JWTValidator.java:519）在 org.wso2.carbon.apimgt.gateway.handle rs.security.jwt.JWTValidator.getJwtValidationInfo(JWTValidator.java:487) at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.authenticate_aroundBody0(JWTValidator.java:170) at org.wso2.carbon. apimgt.gateway.handlers.security.jwt.JWTValidator.authenticate(JWTValidator.java:138) at org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator.authenticate_aroundBody4(OAuthAuthenticator.java:323) at org. wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator.authenticate(OAuthAuthenticator.java:115) at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate_aroundBody42(APIAuthenticationHandler.java:428) at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate(APIAuthenticationHandler.java:422) 在 org.8828 8002658488.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest_aroundBody36(APIAuthenticationHandler.java:353) at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest(APIAuthenticationHandler.java:317) at org. apache.synapse.api.API.process(API.java:389) at org.apache.synapse.api.AbstractApiHandler.apiProcessNonDefaultStrategy(AbstractApiHandler.java:107) at org.apache.synapse.api.AbstractApiHandler.identifyAPI(AbstractApiHandler.java: 127) at org.apache.synapse.api.AbstractApiHandler.dispatchToAPI(AbstractApiHandler.java:59) at org.apache.synapse.api.rest.RestRequestHandler.dispatchToAPI(RestRequestHandler.java:84) at org.apache.synapse.api.rest.RestRequestHandler .process(RestRequestHandler.java :70) at org.apache.synapse.rest.RESTRequestHandler.process(RESTRequestHandler.java:54) at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:344) at org.apache.synapse. core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker. java:375) 在 org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:189) 在 org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run.88641728(NativeWorkerPo728) java.base/java.util.concurrent.ThreadPoolExecutor.runWorker（ThreadPoolExecutor.java:1128）在 java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run（ThreadPoolExecutor.882415382869 :628) 位于 java.base/java.lang.Thread.run(Thread.java:834) Native Method) at java.base/java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:399) at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:242) at java.base/java.net. AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:224) at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:403) at java.base/java.net.Socket.connect(Socket.java:591) at org .apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:368) at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOper java:142)
你知道我错过了什么吗？
反向 apim-bo 虚拟主机：
upstream apimbo {
server 192.168.0.6:9443;
}
server {
# Listen
server_name apimbo.mysite.com;
listen 443 ssl http2;
listen [::]:443 ssl http2;
# Certs
ssl_certificate /home/user/certs/mysite.com.fullchain.pem;
ssl_certificate_key /home/user/certs/mysite.com.privkey.key;
# Proxy conf
location / {
proxy_pass https://apimbo;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_connect_timeout 90s;
proxy_send_timeout 90s;
proxy_read_timeout 90s;
}
}
反向 apim-gw 虚拟主机：
upstream apim {
server 192.168.0.5:8243;
keepalive 32;
}
server {
# Listen
server_name apim.mysite.com;
listen 443 ssl http2;
listen [::]:443 ssl http2;
# Certs
ssl_certificate /home/user/certs/mysite.com.fullchain.pem;
ssl_certificate_key /home/user/certs/mysite.com.privkey.key;
# Proxy conf
location / {
proxy_pass https://apim;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header Connection "";
proxy_connect_timeout 90s;
proxy_send_timeout 90s;
proxy_read_timeout 90s;
}
}
apim-bo /etc/hosts:
127.0.1.1 apimbo.mysite.com
127.0.0.1 localhost
192.168.0.5 apim.mysite.com
apim-bo deployment.toml：
[server]
hostname = "apimbo.mysite.com"
base_path = "${carbon.protocol}://${carbon.host}:${carbon.management.port}"
server_role = "control-plane"
[super_admin]
username = "admin"
password = "adminpass"
create_admin_account = true
[user_store]
type = "database_unique_id"
[database.apim_db]
type = "mysql"
hostname = "192.168.0.4"
name = "apimdb"
port = "3306"
username = "apimdbuser"
password = "apimdbpass"
driver = "com.mysql.cj.jdbc.Driver"
[database.shared_db]
type = "mysql"
hostname = "192.168.0.4"
name = "apimshareddb"
port = "3306"
username = "apimshareddbuser"
password = "apimshareddbpass"
driver = "com.mysql.cj.jdbc.Driver"
[keystore.tls]
file_name = "wso2carbon.jks"
type = "PKCS12"
password = "wso2"
alias = "apim"
key_password = "wso2"
[keystore.primary]
file_name = "wso2carbon.jks"
type = "{{ wso2_keystore_type }}"
password = "{{ wso2_keystore_new_password }}"
alias = "{{ wso2_keystore_new_alias }}"
key_password = "{{ wso2_keystore_new_password }}"
[keystore.internal]
file_name = "wso2carbon.jks"
type = "PKCS12"
password = "{{ wso2_keystore_new_password }}"
alias = "{{ wso2_keystore_new_alias }}"
key_password = "{{ wso2_keystore_new_password }}"
[truststore]
file_name = "client-truststore.jks"
type = "PKCS12"
password = "wso2"
alias = "symmetric.key.value"
algorithm = "AES"
# Custom : apim gateway env
[[apim.gateway.environment]]
name = "Default"
type = "hybrid"
display_in_api_console = true
description = "This is a hybrid gateway that handles both production and sandbox token traffic."
show_as_token_endpoint_url = true
service_url = "https://apim.mysite.com/services/"
username= "${admin.username}"
password= "${admin.password}"
ws_endpoint = "ws://apim.mysite.com:9099"
wss_endpoint = "wss://apim.mysite.com:8099"
http_endpoint = "http://apim.mysite.com"
https_endpoint = "https://apim.mysite.com"
[apim.cache.tags]
expiry_time = "2m"
[apim.cache.jwt_claim]
enable = true
[apim.cache.gateway_token]
enable = true
[apim.cache.resource]
enable = true
[apim.cache.km_token]
enable = true
[apim.cache.scopes]
enable = true
[apim.oauth_config]
revoke_endpoint = "https://apimbo.mysite.com/oauth2/revoke"
[apim.devportal]
url = "https://apimbo.mysite.com/devportal"
api_key_alias = "apim"
display_multiple_versions = true
[apim.cors]
allow_origins = "*"
allow_methods = ["GET","PUT","POST","DELETE","PATCH","OPTIONS"]
allow_headers = ["authorization","Access-Control-Allow-Origin","Content-Type","SOAPAction", "apikey","Internal-Key"]
allow_credentials = false
[apim.workflow]
token_endpoint = "https://apimbo.mysite.com/oauth2/token"
[apim.notification]
hostname = "apimbo.mysite.com"
[[event_handler]]
name="userPostSelfRegistration"
subscriptions=["POST_ADD_USER"]
[service_provider]
sp_name_regex = "^[\\sa-zA-Z0-9._-]*$"
[database.local]
url = "jdbc:h2:./repository/database/WSO2CARBON_DB;DB_CLOSE_ON_EXIT=FALSE"
[[event_listener]]
id = "token_revocation"
type = "org.wso2.carbon.identity.core.handler.AbstractIdentityHandler"
name = "org.wso2.is.notification.ApimOauthEventInterceptor"
order = 1
[event_listener.properties]
notification_endpoint = "https://localhost:${mgt.transport.https.port}/internal/data/v1/notify"
username = "${admin.username}"
password = "${admin.password}"
'header.X-WSO2-KEY-MANAGER' = "default"
[transport.https.properties]
proxyPort = 443
apim-gw /etc/hosts:
127.0.1.1 apim.mysite.com
127.0.0.1 localhost
192.168.0.6 apimbo.mysite.com
apim-gw deployment.toml：
[server]
hostname = "apim.mysite.com"
server_role = "gateway-worker"
[super_admin]
username = "admin"
password = "adminpass"
create_admin_account = true
[user_store]
type = "database_unique_id"
[database.shared_db]
type = "mysql"
hostname = "192.168.0.4"
name = "apimshareddb"
port = "3306"
username = "apimshareddbname"
password = "apimshareddbpass"
driver = "com.mysql.cj.jdbc.Driver"
[keystore.tls]
file_name = "wso2carbon.jks"
type = "PKCS12"
password = "wso2"
alias = "apim"
key_password = "wso2"
[keystore.primary]
file_name = "wso2carbon.jks"
type = "PKCS12"
password = "wso2"
alias = "apim"
key_password = "wso2"
[keystore.internal]
file_name = "wso2carbon.jks"
type = "PKCS12"
password = "wso2"
alias = "apim"
key_password = "wso2"
[truststore]
file_name = "client-truststore.jks"
type = "PKCS12"
password = "wso2"
alias = "symmetric.key.value"
algorithm = "AES"
[apim.key_manager]
service_url = "https://apimbo.mysite.com:9443${carbon.context}/services/"
username= "$ref{super_admin.username}"
password= "$ref{super_admin.password}"
[apim.jwt]
enable = true
encoding = "base64"
claim_dialect = "http://wso2.org/claims"
header = "X-JWT-Assertion"
signing_algorithm = "SHA256withRSA"
[apim.sync_runtime_artifacts.gateway]
gateway_labels = ["Default"]
[apim.throttling]
service_url = "https://apimbo.mysite.com:9443/services/"
username = "$ref{super_admin.username}"
password = "$ref{super_admin.password}"
enable_unlimited_tier = true
enable_header_based_throttling = false
enable_jwt_claim_based_throttling = false
enable_query_param_based_throttling = false
throttle_decision_endpoints = ["tcp://apimbo.mysite.com:5672","tcp://apimbo.mysite.com:5672"]
[[apim.throttling.url_group]]
traffic_manager_urls=["tcp://apimbo.mysite.com:9611"]
traffic_manager_auth_urls=["ssl://apimbo.mysite.com:9711"]
[apim.analytics]
enable = false
config_endpoint = "https://analytics-event-auth.choreo.dev/auth/v1"
auth_token = "ffffffff-ffff-ffff-ffff-ffffffffffff"
[apim.cache.jwt_claim]
enable = true
expiry_time = 900
[apim.cache.gateway_token]
enable = true
expiry_time = 15
[apim.cache.resource]
enable = true
[apim.cache.km_token]
enable = true
[apim.oauth_config]
remove_outbound_auth_header = true
auth_header = "Authorization"
[apim.devportal]
api_key_alias = "apim"
[apim.cors]
allow_origins = "*"
allow_methods = ["GET","PUT","POST","DELETE","PATCH","OPTIONS"]
allow_headers = ["authorization","Access-Control-Allow-Origin","Content-Type","SOAPAction", "apikey"]
allow_credentials = false
[transport.http]
properties.port = 9763
properties.proxyPort = 80
[transport.https]
properties.port = 9443
properties.proxyPort = 443
[passthru_http]
worker_thread_keepalive_sec = 60
worker_pool_queue_length = -1
core_worker_pool_size = 400
max_worker_pool_size = 400
io_buffer_size = 16384
http.socket.timeout = 180000
[message_builder]
json = "org.apache.synapse.commons.json.JsonStreamBuilder"
将以下配置添加到您的控制平面 deployment.toml
如果你只有一台服务器。
[apim.key_manager]
service_url = "https://localhost:9443/services/"
username = "admin"
password = "admin"
如果您有 HA 设置
[apim.key_manager]
service_url = "https://CP_LB_HOST/services/"
username = "admin"
password = "admin"
更新
添加以下内容以更改 JWKS 端点。
[[apim.jwt.issuer]]
name = "https://localhost:9443/oauth2/token"
jwks.url = "https://CP_HOST:9443/oauth2/jwks"
好的，我设法将控制平面配置为密钥管理器，所以我的错误终于消失了。
基本上，网关试图在网关端声明 /oauth2/jwks，而不是通过控制平面调用它。 特别感谢你@ycr，你帮了我很多。
deployment.toml 没有任何效果（对我来说它看起来像一个错误），但我成功地使用了管理面板：
我重新启动了 gw 和 cp 以确保重新启动后该值没有被覆盖，事实并非如此。
WSO2 API 管理器连接错误，“向给定端点 url 发送 HEAD 请求时出错”
[英]WSO2 API Manager Connection Error , "Error occurred while sending the HEAD request to the given endpoint url"
WSO2 API Manager 4.0.0 如何使用@字符作为密码？
[英]How to use the @ character as a password in WSO2 API Manager 4.0.0?
如何在开源 wso2 API Manager 4.0.0 和 wso2 Micro Integrator 1.2.0 上应用错误修复
[英]how to apply bug fixes on open source wso2 API Manager 4.0.0 and wso2 Micro Integrator 1.2.0
WSO2 API Manager(wso2am-4.0.0) - 在分布式设置中“注册的回调与提供的 url 不匹配”
[英]WSO2 API Manager(wso2am-4.0.0) - "Registered callback does not match with the provided url" in a distributed setup
WSO2 API Manager(wso2am-4.0.0) - 最新版本中的突触配置在哪里？
[英]WSO2 API Manager(wso2am-4.0.0) - Where are the synapse configurations located in the latest version?
WSO2 API 经理和 WSO2 密钥经理：未验证用户角色
[英]WSO2 API Manager and WSO2 key manager: user roles are not validated
我在 wso2 apim 4.0.0 上部署了一个 soap 服务。 在使用 api 时，我在第 1 行随机收到错误：prolog 中不允许使用内容
[英]I have a soap service deployed on wso2 apim 4.0.0. While working with the api I randomly get Error on line 1: Content is not allowed in prolog
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.