配置Keycloak 22.0.4为WSO2 APIM密钥管理器时遇Token错误求助

错误日志 #

[2024-03-29 11:11:32,491] ERROR - AccessTokenGenerator Error occurred when generating a new Access token. Server responded with 400
[2024-03-29 11:11:32,646] ERROR - APIUtil Error occurred while executing SubscriberKeyMgtClient.
feign.FeignException$Unauthorized: [401 Unauthorized] during [POST] to [http://0.0.0.0:8080/realms/master/clients-registrations/openid-connect] [DCRClient#createApplication(ClientInfo)]: [{"error":"invalid_token","error_description":"Failed decode token"}]
    at feign.FeignException.clientErrorStatus(FeignException.java:215) ~[io.github.openfeign.feign-core_11.9.1.jar:?]
    at feign.FeignException.errorStatus(FeignException.java:194) ~[io.github.openfeign.feign-core_11.9.1.jar:?]
    at feign.FeignException.errorStatus(FeignException.java:185) ~[io.github.openfeign.feign-core_11.9.1.jar:?]
    at feign.codec.ErrorDecoder$Default.decode(ErrorDecoder.java:92) ~[io.github.openfeign.feign-core_11.9.1.jar:?]
    at feign.AsyncResponseHandler.handleResponse(AsyncResponseHandler.java:98) ~[io.github.openfeign.feign-core_11.9.1.jar:?]
    at feign.SynchronousMethodHandler.executeAndDecode(SynchronousMethodHandler.java:141) ~[io.github.openfeign.feign-core_11.9.1.jar:?]
    at feign.SynchronousMethodHandler.invoke(SynchronousMethodHandler.java:91) ~[io.github.openfeign.feign-core_11.9.1.jar:?]
    at feign.ReflectiveFeign$FeignInvocationHandler.invoke(ReflectiveFeign.java:100) ~[io.github.openfeign.feign-core_11.9.1.jar:?]
    at jdk.proxy35.$Proxy467.createApplication(Unknown Source) ~[?:?]
    at org.wso2.keycloak.client.KeycloakClient.createApplication(KeycloakClient.java:134) ~[keycloak.key.manager_2.1.0.jar:?]
    at org.wso2.carbon.apimgt.impl.workflow.AbstractApplicationRegistrationWorkflowExecutor.dogenerateKeysForApplication_aroundBody8(AbstractApplicationRegistrationWorkflowExecutor.java:153) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.workflow.AbstractApplicationRegistrationWorkflowExecutor.dogenerateKeysForApplication(AbstractApplicationRegistrationWorkflowExecutor.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.workflow.AbstractApplicationRegistrationWorkflowExecutor.generateKeysForApplication_aroundBody6(AbstractApplicationRegistrationWorkflowExecutor.java:120) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.workflow.AbstractApplicationRegistrationWorkflowExecutor.generateKeysForApplication(AbstractApplicationRegistrationWorkflowExecutor.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.workflow.ApplicationRegistrationSimpleWorkflowExecutor.complete_aroundBody2(ApplicationRegistrationSimpleWorkflowExecutor.java:77) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.workflow.ApplicationRegistrationSimpleWorkflowExecutor.complete(ApplicationRegistrationSimpleWorkflowExecutor.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.workflow.ApplicationRegistrationSimpleWorkflowExecutor.execute_aroundBody0(ApplicationRegistrationSimpleWorkflowExecutor.java:54) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.workflow.ApplicationRegistrationSimpleWorkflowExecutor.execute(ApplicationRegistrationSimpleWorkflowExecutor.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.APIConsumerImpl.requestApprovalForApplicationRegistration_aroundBody106(APIConsumerImpl.java:2313) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.impl.APIConsumerImpl.requestApprovalForApplicationRegistration(APIConsumerImpl.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.76.jar:?]
    at org.wso2.carbon.apimgt.rest.api.store.v1.impl.ApplicationsApiServiceImpl.applicationsApplicationIdGenerateKeysPost(ApplicationsApiServiceImpl.java:788) ~[?:?]

问题背景 #

配置Keycloak 22.0.4作为WSO2 APIM 4.2.0的密钥管理器时，生成应用密钥阶段出现上述400/401错误，已核对URL配置但问题未解决。

排查方案 #

1. 修复管理员令牌生成配置 #

• 确认WSO2 APIM密钥管理器中的Client ID和Client Secret，对应Keycloak中创建的管理员级客户端：需开启Service Accounts Enabled，并赋予manage-clients、create-clients核心权限。
• 替换Token端点URL中的0.0.0.0为Keycloak实际可访问的IP/域名，格式应为http://<keycloak-host>:<port>/realms/<realm-name>/protocol/openid-connect/token。

2. 验证动态客户端注册（DCR）权限 #

• 进入Keycloak目标Realm设置 → Clients Registration，确保OpenID Connect Dynamic Client Registration已启用，同时将WSO2 APIM的IP/域名加入Allowed Origins列表。
• 手动获取管理员令牌：调用Keycloak令牌端点，用Client ID/Secret获取令牌后，解析令牌确认scope或roles字段包含create-client权限。

3. 适配密钥管理器版本 #

WSO2 APIM 4.2.0默认的Keycloak密钥管理器插件可能不兼容Keycloak 22，需替换为适配Keycloak 21+版本的插件：

• 替换<APIM_HOME>/repository/components/dropins下的旧keycloak.key.manager_*.jar文件，重启APIM生效。

4. 解决令牌解码问题 #

• 若Keycloak启用HTTPS，将Keycloak的CA证书导入WSO2 APIM的客户端信任库：<APIM_HOME>/repository/resources/security/client-truststore.jks。
• 核对APIM密钥管理器配置中的公钥：从Keycloak Realm设置 → Keys → Public Keys获取RS256算法的公钥，复制到APIM配置字段，确保无多余换行或空格。

5. 开启调试日志定位细节 #

修改<APIM_HOME>/repository/conf/log4j2.properties，添加并配置DEBUG日志：

loggers = ..., feign, org.wso2.keycloak.client
logger.feign.name = feign
logger.feign.level = DEBUG
logger.org.wso2.keycloak.client.name = org.wso2.keycloak.client
logger.org.wso2.keycloak.client.level = DEBUG

重启APIM后，查看生成令牌和DCR请求的详细参数，定位具体错误点。

内容的提问来源于stack exchange，提问作者KASUNI DULANGA