部署在AWS Lambda的Micronaut应用抛出JWKS Bean注入错误

问题 #

我有一个Micronaut Kotlin应用，部署在AWS Lambda中作为API Gateway代理。本地运行正常，使用以下配置通过身份提供商（IDP）的JWKS调用API：

---
micronaut:
  application:
    name: video-translation-api
  serde:
    maximum-nesting-depth: 2000
  security:
    enabled: true
    token:
      jwt:
        signatures:
          jwks:
            auth0:
              url: ${JWT_SIGNATURE}


datasources:
  default:
    driverClassName: org.postgresql.Driver
    dialect: POSTGRES
    username: ${DATABASE_USERNAME:""}
    password: ${DATABASE_PASSWORD:""}
    url: ${DATABASE_URL:""}

---
jpa:
  default:
    properties:
      hibernate:
        bytecode:
          provider: none
        hbm2ddl:
          auto: validate
        show_sql: false

部署到Lambda后出现以下错误：

Bean definition [io.micronaut.security.token.jwt.signature.jwks.HttpClientJwksClient] could not be loaded: Failed to inject value for parameter [clientRegistry] of class: io.micronaut.security.token.jwt.signature.jwks.HttpClientJwksClient

Message: No bean of type [io.micronaut.http.client.HttpClientRegistry<io.micronaut.http.client.HttpClient>] exists. 
* [HttpClientRegistry<HttpClient>] is disabled because it is within the package [io.micronaut.http.client] which is disabled due to bean requirements: 
 - No bean of type [io.micronaut.http.client.HttpClientRegistry] present within context
Path Taken: new HttpClientJwksClient(BeanContext beanContext,HttpClientRegistry clientRegistry,HttpClientConfiguration defaultClientConfiguration) --> new HttpClientJwksClient(BeanContext beanContext,[HttpClientRegistry clientRegistry],HttpClientConfiguration defaultClientConfiguration): io.micronaut.context.exceptions.BeanInstantiationException
io.micronaut.context.exceptions.BeanInstantiationException: Bean definition [io.micronaut.security.token.jwt.signature.jwks.HttpClientJwksClient] could not be loaded: Failed to inject value for parameter [clientRegistry] of class: io.micronaut.security.token.jwt.signature.jwks.HttpClientJwksClient

Message: No bean of type [io.micronaut.http.client.HttpClientRegistry<io.micronaut.http.client.HttpClient>] exists. 
* [HttpClientRegistry<HttpClient>] is disabled because it is within the package [io.micronaut.http.client] which is disabled due to bean requirements: 
 - No bean of type [io.micronaut.http.client.HttpClientRegistry] present within context
Path Taken: new HttpClientJwksClient(BeanContext beanContext,HttpClientRegistry clientRegistry,HttpClientConfiguration defaultClientConfiguration) --> new HttpClientJwksClient(BeanContext beanContext,[HttpClientRegistry clientRegistry],HttpClientConfiguration defaultClientConfiguration)
    at io.micronaut.context.DefaultBeanContext.initializeContext(DefaultBeanContext.java:2003)
    at io.micronaut.context.DefaultApplicationContext.initializeContext(DefaultApplicationContext.java:294)
    at io.micronaut.context.DefaultBeanContext.readAllBeanDefinitionClasses(DefaultBeanContext.java:3384)
    at io.micronaut.context.DefaultBeanContext.finalizeConfiguration(DefaultBeanContext.java:3739)
    at io.micronaut.context.DefaultBeanContext.start(DefaultBeanContext.java:363)
    at io.micronaut.context.DefaultApplicationContext.start(DefaultApplicationContext.java:202)
    at io.micronaut.function.executor.AbstractExecutor.startEnvironment(AbstractExecutor.java:124)
    at io.micronaut.function.executor.FunctionInitializer.startThis(FunctionInitializer.java:124)
    at io.micronaut.function.executor.FunctionInitializer.<init>(FunctionInitializer.java:49)
    at io.micronaut.function.aws.proxy.payload1.ApiGatewayProxyRequestEventFunction.<init>(ApiGatewayProxyRequestEventFunction.java:38)
    at io.micronaut.function.aws.proxy.MicronautLambdaHandler.<init>(MicronautLambdaHandler.java:36)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
    at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Unknown Source)
    at java.base/java.lang.reflect.Constructor.newInstance(Unknown Source)
Caused by: io.micronaut.context.exceptions.DependencyInjectionException: Failed to inject value for parameter [clientRegistry] of class: io.micronaut.security.token.jwt.signature.jwks.HttpClientJwksClient

Message: No bean of type [io.micronaut.http.client.HttpClientRegistry<io.micronaut.http.client.HttpClient>] exists. 
* [HttpClientRegistry<HttpClient>] is disabled because it is within the package [io.micronaut.http.client] which is disabled due to bean requirements: 
 - No bean of type [io.micronaut.http.client.HttpClientRegistry] present within context
Path Taken: new HttpClientJwksClient(BeanContext beanContext,HttpClientRegistry clientRegistry,HttpClientConfiguration defaultClientConfiguration) --> new HttpClientJwksClient(BeanContext beanContext,[HttpClientRegistry clientRegistry],HttpClientConfiguration defaultClientConfiguration)
    at io.micronaut.context.AbstractInitializableBeanDefinition.resolveBean(AbstractInitializableBeanDefinition.java:2181)
    at io.micronaut.context.AbstractInitializableBeanDefinition.getBeanForConstructorArgument(AbstractInitializableBeanDefinition.java:1328)
    at io.micronaut.security.token.jwt.signature.jwks.$HttpClientJwksClient$Definition.instantiate(Unknown Source)
    at io.micronaut.context.DefaultBeanContext.resolveByBeanFactory(DefaultBeanContext.java:2332)
    at io.micronaut.context.DefaultBeanContext.doCreateBean(DefaultBeanContext.java:2302)
    at io.micronaut.context.DefaultBeanContext.doCreateBean(DefaultBeanContext.java:2314)
    at io.micronaut.context.DefaultBeanContext.createRegistration(DefaultBeanContext.java:3116)
    at io.micronaut.context.SingletonScope.getOrCreate(SingletonScope.java:80)
    at io.micronaut.context.DefaultBeanContext.findOrCreateSingletonBeanRegistration(DefaultBeanContext.java:3018)
    at io.micronaut.context.DefaultBeanContext.initializeEagerBean(DefaultBeanContext.java:2699)
    at io.micronaut.context.DefaultBeanContext.initializeContext(DefaultBeanContext.java:1997)
    ... 15 more
Caused by: io.micronaut.context.exceptions.NoSuchBeanException: No bean of type [io.micronaut.http.client.HttpClientRegistry<io.micronaut.http.client.HttpClient>] exists. 
* [HttpClientRegistry<HttpClient>] is disabled because it is within the package [io.micronaut.http.client] which is disabled due to bean requirements: 
 - No bean of type [io.micronaut.http.client.HttpClientRegistry] present within context
    at io.micronaut.context.DefaultBeanContext.newNoSuchBeanException(DefaultBeanContext.java:2789)
    at io.micronaut.context.DefaultApplicationContext.newNoSuchBeanException(DefaultApplicationContext.java:309)
    at io.micronaut.context.DefaultBeanContext.resolveBeanRegistration(DefaultBeanContext.java:2758)
    at io.micronaut.context.DefaultBeanContext.getBean(DefaultBeanContext.java:1752)
    at io.micronaut.context.AbstractBeanResolutionContext.getBean(AbstractBeanResolutionContext.java:89)
    at io.micronaut.context.AbstractInitializableBeanDefinition.resolveBean(AbstractInitializableBeanDefinition.java:2165)
    ... 25 more

禁用security: enabled: true后应用可正常运行，确认问题与Micronaut处理JWKS的逻辑相关。已尝试通过环境变量直接加载JWKS、开放Lambda网络权限，但问题依旧。

解决方案 #

1. 补充HTTP Client依赖 #

Lambda环境下Micronaut默认可能不会自动引入HTTP Client依赖，需手动添加：

Gradle Kotlin DSL

implementation("io.micronaut:micronaut-http-client")

Maven

<dependency>
    <groupId>io.micronaut</groupId>
    <artifactId>micronaut-http-client</artifactId>
</dependency>

2. 强制启用HTTP Client #

Lambda环境中Micronaut会自动禁用非必要bean优化性能，可通过配置强制启用HTTP Client：

在application.yml中添加：

micronaut:
  http:
    client:
      enabled: true

3. 替换JWKS客户端实现 #

改用基于UrlConnection的JWKS客户端，避免依赖Micronaut HTTP Client：

1. 添加依赖：

Gradle Kotlin DSL

implementation("io.micronaut.security:micronaut-security-token-jwt-signature-jwks-urlconnection")

Maven

<dependency>
    <groupId>io.micronaut.security</groupId>
    <artifactId>micronaut-security-token-jwt-signature-jwks-urlconnection</artifactId>
</dependency>

2. 修改配置指定客户端：

micronaut:
  security:
    token:
      jwt:
        signatures:
          jwks:
            auth0:
              url: ${JWT_SIGNATURE}
              client: urlconnection

4. 预加载静态JWKS密钥（可选） #

若Lambda无法访问外部IDP，可直接预加载公钥：

micronaut:
  security:
    token:
      jwt:
        signatures:
          jwks:
            auth0:
              keys:
                - |
                  -----BEGIN PUBLIC KEY-----
                  # 替换为你的IDP公钥内容
                  -----END PUBLIC KEY-----

内容的提问来源于stack exchange，提问作者alepeltier