錯誤{org.wso2.carbon.idp.mgt.util.IdPManagementUtil}-訪問用於租戶的IdentityProviderManager時出錯

Question

登錄時在WSO2IS 5.1.0中獲取此異常。

[2017-01-28 20:12:22,384] ERROR {org.wso2.carbon.idp.mgt.util.IdPManagementUtil} -  Error when accessing the IdentityProviderManager for tenant : xyz.com org.wso2.carbon.idp.mgt.IdentityProviderManagementException: Error retrieving primary certificate for tenant : xyz.com
        at org.wso2.carbon.idp.mgt.IdentityProviderManager.getResidentIdP(IdentityProviderManager.java:214)
        at org.wso2.carbon.idp.mgt.util.IdPManagementUtil.getRememberMeTimeout(IdPManagementUtil.java:98)
        at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultAuthenticationRequestHandler.setAuthCookie(DefaultAuthenticationRequestHandler.java:347)
        at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultAuthenticationRequestHandler.concludeFlow(DefaultAuthenticationRequestHandler.java:284)
        at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultAuthenticationRequestHandler.handle(DefaultAuthenticationRequestHandler.java:120)
        at org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator.handle(DefaultRequestCoordinator.java:135)
        at org.wso2.carbon.identity.application.authentication.framework.servlet.CommonAuthenticationServlet.doPost(CommonAuthenticationServlet.java:53)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:646)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
        at org.eclipse.equinox.http.helper.ContextPathServletAdaptor.service(ContextPathServletAdaptor.java:37)
        at org.eclipse.equinox.http.servlet.internal.ServletRegistration.service(ServletRegistration.java:61)
        at org.eclipse.equinox.http.servlet.internal.ProxyServlet.processAlias(ProxyServlet.java:128)
        at org.eclipse.equinox.http.servlet.internal.ProxyServlet.service(ProxyServlet.java:60)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
        at org.wso2.carbon.tomcat.ext.servlet.DelegationServlet.service(DelegationServlet.java:68)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.wso2.carbon.ui.filters.CSRFPreventionFilter.doFilter(CSRFPreventionFilter.java:88)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.wso2.carbon.ui.filters.CRLFPreventionFilter.doFilter(CRLFPreventionFilter.java:59)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.wso2.carbon.tomcat.ext.filter.CharacterSetFilter.doFilter(CharacterSetFilter.java:61)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:504)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
        at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:99)
        at org.wso2.carbon.tomcat.ext.valves.CarbonTomcatValve$1.invoke(CarbonTomcatValve.java:47)
        at org.wso2.carbon.webapp.mgt.TenantLazyLoaderValve.invoke(TenantLazyLoaderValve.java:57)
        at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:47)
        at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:62)
        at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:159)
        at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
        at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421)
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1074)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1739)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1698)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:745)

Answer 1

問題出在client-truststore.jks

第1步

用從pfx文件生成的jks文件（提供程序發送的SSL文件）替換wso2appm-1.2.1-SNAPSHOT / repository / resources / security / wso2carbon.jks

在carbon.xml中更改jks文件名，密鑰庫密碼和別名

用您在文件夾wso2appm-1.2.1-SNAPSHOT / repository / resources / security / client-truststore.jks中創建的文件夾替換client-truststore.jks

要創建client-truststore.jks文件，請按照以下步驟操作

keytool -export -alias certalias -keystore your_jks.jks -file .pem

這將生成.pem文件

如果您不知道證書名稱，請按照以下步驟查找並使用正確的別名運行abve命令

在Linux上

keytool -list -v -keystore your_jks.jks | grep“別名” ||創建日期

在Windows上

keytool -list -v -keystore your_jks.jks | findstr“別名創建”

第2步

keytool -import -alias certalias -file .pem -keystore client-truststore.jks -storepass wso2carbon

這將生成client-truststore.jks並將其替換為舊的（wso2appm-1.2.1-SNAPSHOT / repository / resources / security / client-truststore.jks）

現在，在carbon.xml中更改密鑰庫別名（wso2appm-1.2.1-SNAPSHOT / repository / conf / carbon.xml）

運行該應用程序並檢查。

如果仍然出現錯誤，請在“存儲庫/部署/服務器/jaggeryapps/publisher/controllers/acs.jag”中更改下面的identityAlias

var identityAlias = configs.ssoConfiguration.identityAlias;

更改為var identityAlias =“您的身份別名”

Answer 2

我檢查了與錯誤有關的源代碼[1]。 據此，當它嘗試初始化注冊表時，問題就來了[2]。

創建租戶后，服務器將為該租戶創建密鑰庫，並將其存儲在以下注冊表路徑中。

/ _system /治理/存儲庫/安全性/密鑰庫/

如果租戶名稱為xyz.com，則在上述注冊表路徑中，它將創建一個名為xyz-com.jks的Java密鑰庫文件。

注冊表對象存儲在后端數據庫中。 因此，是否有可能找不到上述密鑰庫文件或無法訪問注冊表文件路徑？

[1] https://github.com/wso2/carbon-identity/blob/v5.0.7/components/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon /idp/mgt/IdentityProviderManager.java#L213

[2] https://github.com/wso2/carbon-identity/blob/v5.0.7/components/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon /idp/mgt/IdentityProviderManager.java#L197

Answer 3

這種代碼編寫方式的騷擾。 創建租戶時，將創建默認密鑰存儲並將其存儲在注冊表中。 您顯然不希望這樣做，因此最終將通過更新注冊表並上載新的密鑰庫來替換密鑰庫。 技巧是創建密鑰庫的方法，這是您需要做的

• 租戶域：“ xyz.com”
• 密鑰庫的名稱：“ xyz-com.jks”
• 私鑰條目別名的名稱：“ xyz.com”

現在一切正常。