Mule 4.4 OAuth JWT连接Salesforce出现INVALID_SESSION_ID错误无法自动重连

问题场景 #

基于Mule 4.4的应用，使用Salesforce连接器10.19.2版本，通过OAuth JWT方式连接已启用OAuth的Salesforce连接应用。应用初期运行正常，但经过一段时间后连接持续失败，Mule收到Salesforce返回的错误：INVALID_SESSION_ID: Invalid Session ID found in SessionHeader: Illegal Session。推测故障时间与Salesforce的会话过期时间重合，但不确定具体是哪种会话。已在Salesforce配置中定义了标准重连策略，但会话过期时Mule并未自动刷新连接。

当前Salesforce配置 #

<salesforce:sfdc-config name="Salesforce_Config_OAuth_JWT" doc:name="Salesforce Config" doc:id="ea2c2201-4942-4024-b45c-d444c50bf382" >
    <salesforce:jwt-connection 
        consumerKey="XXXX" 
        keyStore="XXXX.jks" 
        storePassword="XXXX" 
        principal="XXXX">
        <reconnection >
            <reconnect count="5"/>
        </reconnection>
    </salesforce:jwt-connection>
</salesforce:sfdc-config>

相关日志 #

连接验证警告日志 #

DEBUG 2024-01-19 09:40:02,328 [[MuleRuntime].uber.02: [salesforcepoc].uber@org.mule.runtime.core.internal.connection.DefaultConnectivityTesterFactory$1.testConnectivity:81 @4531411d] [processor: ; event: ] org.mule.extension.salesforce.internal.connection.provider.ConnectorConfigBuilder: Receiving response from Salesforce. Arguments: {endpoint=https://personal-3d8-dev-ed.develop.my.salesforce.com/services/Soap/u/59.0, response=<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:sf="urn:fault.partner.soap.sforce.com" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soapenv:Body><soapenv:Fault><faultcode>sf:INVALID_SESSION_ID</faultcode><faultstring>INVALID_SESSION_ID: Invalid Session ID found in SessionHeader: Illegal Session</faultstring><detail><sf:UnexpectedErrorFault xsi:type="sf:UnexpectedErrorFault"><sf:exceptionCode>INVALID_SESSION_ID</sf:exceptionCode><sf:exceptionMessage>Invalid Session ID found in SessionHeader: Illegal Session</sf:exceptionMessage></sf:UnexpectedErrorFault></detail></soapenv:Fault></soapenv:Body></soapenv:Envelope>}.
WARN  2024-01-19 09:40:02,337 [[MuleRuntime].uber.02: [salesforcepoc].uber@org.mule.runtime.core.internal.connection.DefaultConnectivityTesterFactory$1.testConnectivity:81 @4531411d] [processor: ; event: ] org.mule.extension.salesforce.internal.connection.provider.AbstractConnectionProvider: Couldn't validate the connection because an exception occurred. Please check credentials. Root exception was: org.mule.runtime.api.connection.ConnectionException: null
Caused by: org.mule.runtime.api.connection.ConnectionException: null
Caused by: [UnexpectedErrorFault [ApiFault  exceptionCode='INVALID_SESSION_ID'
 exceptionMessage='Invalid Session ID found in SessionHeader: Illegal Session'
 extendedErrorDetails='{[0]}'
]
]

    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

Streaming连接错误日志 #

DEBUG 2024-01-19 09:40:03,164 [HttpClient@bcf806b-123] [processor: ; event: ] org.mule.extension.salesforce.internal.service.streaming.transport.CustomJettyHttpClientTransport: Received messages. Arguments: {messages=[{ext={sfdc={failureReason=401::Authentication invalid}, replay=true, payload.format=true}, advice={reconnect=none}, channel=/meta/handshake, id=1, error=403::Handshake denied, successful=false}], total=1}.
DEBUG 2024-01-19 09:40:03,164 [HttpClient@7d037e76-122] [processor: ; event: ] org.mule.extension.salesforce.internal.service.streaming.transport.CustomJettyHttpClientTransport: Received messages. Arguments: {messages=[{ext={sfdc={failureReason=401::Authentication invalid}, replay=true, payload.format=true}, advice={reconnect=none}, channel=/meta/handshake, id=2, error=403::Handshake denied, successful=false}], total=1}.
INFO  2024-01-19 09:40:03,169 [HttpClient@bcf806b-123] [processor: ; event: ] org.mule.extension.salesforce.internal.service.streaming.listeners.AuthFailureListener: A non-successful message has been received. Error handling routine follows. Arguments: {sdfcFailureReason=401::Authentication invalid, instance=https://personal-3d8-dev-ed.develop.my.salesforce.com/cometd/59.0, channel=BayeuxClientChannel@c00433e[/meta/handshake][BayeuxClient@2fd4c303[null][SessionState@6cb2fcbb[HANDSHAKING]]], error=403::Handshake denied, message={ext={sfdc={failureReason=401::Authentication invalid}, replay=true, payload.format=true}, advice={reconnect=none}, channel=/meta/handshake, id=1, error=403::Handshake denied, successful=false}}.
INFO  2024-01-19 09:40:03,169 [HttpClient@7d037e76-122] [processor: ; event: ] org.mule.extension.salesforce.internal.service.streaming.listeners.AuthFailureListener: A non-successful message has been received. Error handling routine follows. Arguments: {sdfcFailureReason=401::Authentication invalid, instance=https://personal-3d8-dev-ed.develop.my.salesforce.com/cometd/59.0, channel=BayeuxClientChannel@11c92d5f[/meta/handshake][BayeuxClient@253d0f57[null][SessionState@4129782e[HANDSHAKING]]], error=403::Handshake denied, message={ext={sfdc={failureReason=401::Authentication invalid}, replay=true, payload.format=true}, advice={reconnect=none}, channel=/meta/handshake, id=2, error=403::Handshake denied, successful=false}}.
WARN  2024-01-19 09:40:03,169 [HttpClient@bcf806b-123] [processor: ; event: ] org.mule.extension.salesforce.internal.service.streaming.listeners.AuthFailureListener: Couldn't connect to Salesforce streaming server because a 401 error has been returned. Reconnecting. Arguments: {sdfcFailureReason=401::Authentication invalid, message={ext={sfdc={failureReason=401::Authentication invalid}, replay=true, payload.format=true}, advice={reconnect=none}, channel=/meta/handshake, id=1, error=403::Handshake denied, successful=false}, error=403::Handshake denied}.
WARN  2024-01-19 09:40:03,169 [HttpClient@7d037e76-122] [processor: ; event: ] org.mule.extension.salesforce.internal.service.streaming.listeners.AuthFailureListener: Couldn't connect to Salesforce streaming server because a 401 error has been returned. Reconnecting. Arguments: {sdfcFailureReason=401::Authentication invalid, message={ext={sfdc={failureReason=401::Authentication invalid}, replay=true, payload.format=true}, advice={reconnect=none}, channel=/meta/handshake, id=2, error=403::Handshake denied, successful=false}, error=403::Handshake denied}.
INFO  2024-01-19 09:40:03,170 [HttpClient@bcf806b-123] [processor: ; event: ] org.mule.extension.salesforce.internal.source.AbstractStreamingSource: The streaming client needs to restart the source. Notifying the runtime. Arguments: {errorMessage=403::Handshake denied, isNewConnectionNeeded=true}.
INFO  2024-01-19 09:40:03,170 [HttpClient@7d037e76-122] [processor: ; event: ] org.mule.extension.salesforce.internal.source.AbstractStreamingSource: The streaming client needs to restart the source. Notifying the runtime. Arguments: {errorMessage=403::Handshake denied, isNewConnectionNeeded=true}.
ERROR 2024-01-19 09:40:03,172 [HttpClient@7d037e76-122] [processor: ; event: ] org.mule.runtime.core.internal.exception.DefaultSystemExceptionStrategy: 
********************************************************************************
Message               : Access Token expired for resource owner id null
Element               : (None)
Element DSL           : (None)
Error type            : (None)
FlowStack             : (None)

  (set debug level logging or '-Dmule.verbose.exceptions=true' for everything)
********************************************************************************

问题原因分析 #

1. 会话类型混淆：Salesforce的JWT认证生成的是访问令牌（Access Token），而非传统用户会话。访问令牌有过期时间（默认15分钟，可在Salesforce连接应用中配置最长到2小时），当前配置的重连策略仅针对连接失败后的重试，而非主动的令牌刷新。
2. 重连策略配置不足：默认的<reconnect count="5"/>仅定义了重试次数，无重试间隔，且未启用连接验证和自动刷新机制，导致连接器无法检测令牌过期并主动刷新。
3. Streaming客户端依赖：日志中的CometD握手失败（403错误）是因为Streaming客户端依赖的访问令牌过期，而Streaming源的重连逻辑需要配合连接器的令牌刷新机制才能生效。

修复步骤 #

1. 完善Salesforce连接器配置 #

修改JWT连接配置，添加自动令牌刷新、连接验证和合理的重连间隔：

<salesforce:sfdc-config name="Salesforce_Config_OAuth_JWT" doc:name="Salesforce Config" doc:id="ea2c2201-4942-4024-b45c-d444c50bf382" >
    <salesforce:jwt-connection 
        consumerKey="XXXX" 
        keyStore="XXXX.jks" 
        storePassword="XXXX" 
        principal="XXXX">
        <!-- 配置带间隔的重连策略，添加指数退避 -->
        <reconnection >
            <reconnect count="5" frequency="3000" />
        </reconnection>
        <!-- 启用定期连接验证，提前发现令牌过期 -->
        <connection-validation>
            <validate-connection frequency="300000" /> <!-- 每5分钟验证一次 -->
        </connection-validation>
        <!-- 启用自动刷新令牌 -->
        <auto-refresh-token>true</auto-refresh-token>
    </salesforce:jwt-connection>
</salesforce:sfdc-config>

• auto-refresh-token="true"：JWT认证下自动续期的核心配置，连接器会在令牌过期前自动刷新。
• connection-validation：定期验证连接有效性，提前触发令牌刷新。
• reconnect frequency：设置3秒重试间隔，避免频繁重试触发Salesforce限流。

2. 调整Salesforce连接应用配置 #

登录Salesforce后台，进入连接应用配置页：

• 在OAuth 2.0 设置中调整访问令牌有效时间（最长可设为2小时），根据业务需求平衡安全性与稳定性。
• 确认刷新令牌有效时间配置合理（JWT认证下默认有效期较长，无需过度限制）。

3. 验证Streaming源逻辑 #

若应用使用Salesforce Streaming源（如PushTopic、Change Data Capture）：

• 确保Streaming源引用上述更新后的Salesforce连接器。
• 确认Streaming源的自动重连逻辑未被自定义代码覆盖（默认已启用）。

4. 日志验证 #

修改后观察Mule日志：

• 令牌过期前应看到Refreshing access token相关日志条目。
• 连接验证时若检测到令牌过期，会自动触发刷新，而非直接抛出INVALID_SESSION_ID错误。

内容的提问来源于stack exchange，提问作者AndrWeisR