WSO2 APIM更新应用报错：WSO2 IS提示应用所有者用户不存在

使用WSO2 IS (5.11)作为WSO2 APIM (4.1.0)的密钥管理器，可正常在APIM创建应用并通过IS完成登录，但尝试更新应用时，WSO2 IS端抛出如下错误：

[2024-01-19 08:13:30,317] [be0d4b91-1b5b-4b07-819a-46ef921d3a72]  WARN {org.wso2.carbon.identity.oauth.OAuthAdminServiceImpl} - OAuth应用所有者用户名admin@carbon.super在用户存储中不存在。使用用户admin@carbon.super作为应用所有者。
[2024-01-19 08:13:30,320] [be0d4b91-1b5b-4b07-819a-46ef921d3a72] ERROR {org.wso2.carbon.identity.oauth.OAuthAdminService} - org.wso2.carbon.identity.oauth.IdentityOAuthAdminException: 应用所有者更新验证失败，应用admin_1663645e-7a69-4e21-ad99-f1ef6eec4dd3_PRODUCTION对应的用户不存在。
[2024-01-19 08:13:30,392] [be0d4b91-1b5b-4b07-819a-46ef921d3a72] ERROR {org.wso2.is.key.manager.operations.endpoint.impl.DcrApiServiceImpl} - Internal Server Error org.wso2.carbon.identity.oauth.dcr.exception.DCRMServerException: 更新客户端密钥为SN5D_nDnKLX2Z6QAMPspOsiNvxYa的应用时出错
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
    at org.wso2.carbon.identity.base.IdentityException.error(IdentityException.java:100)
    at org.wso2.carbon.identity.oauth.dcr.util.DCRMUtils.generateServerException(DCRMUtils.java:123)
    at org.wso2.is.key.manager.operations.endpoint.dcr.service.DCRMService.updateApplication(DCRMService.java:189)
    at org.wso2.is.key.manager.operations.endpoint.impl.DcrApiServiceImpl.updateApplication(DcrApiServiceImpl.java:136)
    at org.wso2.is.key.manager.operations.endpoint.DcrApi.updateApplication(DcrApi.java:118)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:566)
    at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:179)
    at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:96)
    at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:201)
    at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:104)
    at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59)
    at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
    at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:267)
    at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160)
    at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:225)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:296)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPut(AbstractHTTPServlet.java:232)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:663)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:271)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.wso2.carbon.ui.filters.cache.ContentTypeBasedCachePreventionFilter.doFilter(ContentTypeBasedCachePreventionFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.wso2.carbon.identity.context.rewrite.valve.TenantContextRewriteValve.invoke(TenantContextRewriteValve.java:107)
    at org.wso2.carbon.identity.cors.valve.CORSValve.invoke(CORSValve.java:98)
    at org.wso2.carbon.identity.authz.valve.AuthorizationValve.invoke(AuthorizationValve.java:102)
    at org.wso2.carbon.identity.auth.valve.AuthenticationValve.invoke(AuthenticationValve.java:123)
    at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:99)
    at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:49)
    at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:62)
    at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:145)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)
    at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
    at org.wso2.carbon.tomcat.ext.valves.RequestEncodingValve.invoke(RequestEncodingValve.java:49)
    at org.wso2.carbon.tomcat.ext.valves.RequestCorrelationIdValve.invoke(RequestCorrelationIdValve.java:126)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: org.wso2.carbon.identity.oauth.IdentityOAuthAdminException: 应用所有者更新验证失败，应用admin_1663645e-7a69-4e21-ad99-f1ef6eec4dd3_PRODUCTION对应的用户不存在。
    at org.wso2.carbon.identity.oauth.dao.OAuthAppDAO.validateUserForOwnerUpdate(OAuthAppDAO.java:494)
    at org.wso2.carbon.identity.oauth.dao.OAuthAppDAO.updateConsumerApplication(OAuthAppDAO.java:439)
    at org.wso2.carbon.identity.oauth.OAuthAdminServiceImpl.updateConsumerApplication(OAuthAdminServiceImpl.java:483)
    at org.wso2.carbon.identity.oauth.OAuthAdminService.updateConsumerApplication(OAuthAdminService.java:148)
    at org.wso2.is.key.manager.operations.endpoint.dcr.service.DCRMService.updateApplication(DCRMService.java:187)
    ... 62 more

1. 验证IS中用户的存在性 #

登录WSO2 IS管理控制台（https://<IS_HOST>:9443/carbon），进入用户和角色管理，搜索应用所有者用户（如日志中的admin@carbon.super），确认该用户是否存在于IS的用户存储中。

2. 同步APIM与IS的用户数据 #

若APIM和IS使用独立的用户存储，需配置用户数据同步：

• 配置共享用户存储：将APIM和IS指向同一个JDBC用户存储，确保用户数据一致。
• 使用SCIM同步：通过SCIM API将APIM中的用户同步到IS，或反之。

3. 修正应用所有者配置 #

• 若用户不存在，在IS中手动创建对应的用户账号。
• 在APIM控制台修改目标应用的所有者为IS中已存在的用户，再尝试更新操作。

4. 检查IS用户存储配置 #

确认IS的用户存储配置文件（repository/conf/user-mgt.xml）中的连接参数、用户检索过滤器等配置正确，确保IS能正常读取用户存储中的数据。

5. 临时绕过验证（仅测试环境） #

若为测试场景，可修改IS的OAuth验证逻辑，暂时跳过用户存在性检查，但此方法严禁用于生产环境，会带来安全风险。

内容的提问来源于stack exchange，提问作者user5919369