WSO2 API Manager配置OAuth2时JWT解析错误求助

问题背景 #

基于WSO2 API Manager搭建的项目，API配置为OAuth2应用级安全认证时出现JWT解析错误，但使用API Key认证完全正常。当前deployment.toml中hostname与API网关URL不一致，已尝试采用默认配置及官方传输层安全相关配置，问题仍未解决。

当前配置（deployment.toml） #

[server]
hostname = "apim.sit.company.com"
...

[[apim.gateway.environment]]
name = "Default"
type = "hybrid"
provider = "wso2"
display_in_api_console = true
description = "This is a hybrid gateway that handles both production and sandbox token traffic."
show_as_token_endpoint_url = true
service_url = "https://localhost:${mgt.transport.https.port}/services/"
username= "${admin.username}"
password= "${admin.password}"
ws_endpoint = "ws://localhost:9099"
wss_endpoint = "wss://localhost:8099"
http_endpoint = "http://apimgw.sit.company.com"
https_endpoint = "https://apimgw.sit.company.com"

日志报错信息 #

[2023-04-18 06:24:40,959] ERROR - JWTValidatorImpl Error while parsing JWT
java.text.ParseException: Unexpected exception: Cannot invoke "String.length()" because "in" is null
        at com.nimbusds.jose.util.JSONObjectUtils.parse(JSONObjectUtils.java:77) ~[nimbus-jose-jwt_7.9.0.wso2v1.jar:?]
        at com.nimbusds.jose.jwk.JWKSet.parse(JWKSet.java:309) ~[nimbus-jose-jwt_7.9.0.wso2v1.jar:?]
        at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.retrieveJWKSet_aroundBody22(JWTValidatorImpl.java:227) ~[org.wso2.carbon.apimgt.impl_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.retrieveJWKSet(JWTValidatorImpl.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateSignature_aroundBody8(JWTValidatorImpl.java:144) ~[org.wso2.carbon.apimgt.impl_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateSignature(JWTValidatorImpl.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateToken_aroundBody0(JWTValidatorImpl.java:61) ~[org.wso2.carbon.apimgt.impl_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.impl.jwt.JWTValidatorImpl.validateToken(JWTValidatorImpl.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.impl.jwt.JWTValidationServiceImpl.validateJWTToken_aroundBody0(JWTValidationServiceImpl.java:44) ~[org.wso2.carbon.apimgt.impl_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.impl.jwt.JWTValidationServiceImpl.validateJWTToken(JWTValidationServiceImpl.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.getJwtValidationInfo_aroundBody32(JWTValidator.java:673) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.getJwtValidationInfo(JWTValidator.java:1) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.authenticate_aroundBody0(JWTValidator.java:181) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.jwt.JWTValidator.authenticate(JWTValidator.java:1) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator.authenticate_aroundBody4(OAuthAuthenticator.java:298) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator.authenticate(OAuthAuthenticator.java:1) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate_aroundBody56(APIAuthenticationHandler.java:546) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate(APIAuthenticationHandler.java:1) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest_aroundBody46(APIAuthenticationHandler.java:416) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest(APIAuthenticationHandler.java:1) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.apache.synapse.api.API.process(API.java:403) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.AbstractApiHandler.apiProcessNonDefaultStrategy(AbstractApiHandler.java:108) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.AbstractApiHandler.identifyAPI(AbstractApiHandler.java:128) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.AbstractApiHandler.dispatchToAPI(AbstractApiHandler.java:60) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.rest.RestRequestHandler.dispatchToAPI(RestRequestHandler.java:90) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.rest.RestRequestHandler.process(RestRequestHandler.java:76) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.rest.RESTRequestHandler.process(RESTRequestHandler.java:54) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:346) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v83.jar:?]
        at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:379) ~[synapse-nhttp-transport_4.0.0.wso2v20.jar:?]
        at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:193) ~[synapse-nhttp-transport_4.0.0.wso2v20.jar:?]
        at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v83.jar:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
        at java.lang.Thread.run(Thread.java:833) [?:?]
[2023-04-18 06:24:40,971] ERROR - APIAuthenticationHandler API authentication failure due to Unclassified Authentication Failure
org.wso2.carbon.apimgt.gateway.handlers.security.APISecurityException: Unclassified Authentication Failure
        at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate_aroundBody56(APIAuthenticationHandler.java:560) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate(APIAuthenticationHandler.java:1) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest_aroundBody46(APIAuthenticationHandler.java:416) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest(APIAuthenticationHandler.java:1) ~[org.wso2.carbon.apimgt.gateway_9.28.116.jar:?]
        at org.apache.synapse.api.API.process(API.java:403) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.AbstractApiHandler.apiProcessNonDefaultStrategy(AbstractApiHandler.java:108) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.AbstractApiHandler.identifyAPI(AbstractApiHandler.java:128) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.AbstractApiHandler.dispatchToAPI(AbstractApiHandler.java:60) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.rest.RestRequestHandler.dispatchToAPI(RestRequestHandler.java:90) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.api.rest.RestRequestHandler.process(RestRequestHandler.java:76) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.rest.RESTRequestHandler.process(RESTRequestHandler.java:54) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:346) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_4.0.0.wso2v20.jar:4.0.0-wso2v20]
        at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v83.jar:?]
        at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:379) ~[synapse-nhttp-transport_4.0.0.wso2v20.jar:?]
        at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:193) ~[synapse-nhttp-transport_4.0.0.wso2v20.jar:?]
        at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v83.jar:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
        at java.lang.Thread.run(Thread.java:833) [?:?]
[2023-04-18 06:24:40,972]  WARN - RelayUtils Server encountered an error, the request message will be consumed and discarded, , CLIENT_ADDRESS = /10.44.137.163:34368, Correlation ID = 979050c7-db12-4790-8991-6e4b64bab89c
[2023-04-18 06:24:51,824]  WARN - APIUtil The configurations related to Api Key Generator Impl class in APIStore is missing in api-manager.xml. Hence returning the default value.
[2023-04-18 06:24:51,897]  WARN - APIUtil The configurations related to APIKey sign keystore in APIStore is missing in api-manager.xml. Hence returning the default value.
[2023-04-18 06:24:51,917]  WARN - APIUtil The configurations related to APIKey sign keystore in APIStore is missing in api-manager.xml. Hence returning the default value.

问题分析与解决方案 #

从报错栈可以看出，核心问题是网关尝试获取JWK（JSON Web Key）集时返回了空内容，导致解析失败。结合配置信息，以下是针对性修复步骤：

1. 修正网关的APIM服务地址 #

当前service_url使用localhost，但APIM的外部主机名是apim.sit.company.com，若网关与APIM不在同一节点或容器化部署时，localhost无法正确指向APIM服务，导致无法获取JWKS。

修改配置：
将deployment.toml中的service_url替换为APIM的外部可访问地址：

service_url = "https://apim.sit.company.com:${mgt.transport.https.port}/services/"

2. 配置网关的JWKS端点 #

显式指定APIM的JWKS端点，确保网关能正确获取验证JWT所需的密钥：

[apim.oauth_config]
jwks_url = "https://apim.sit.company.com/oauth2/jwks"

3. 解决TLS信任问题 #

若网关与APIM之间的SSL证书未被信任，请求JWKS时会被阻断并返回空内容。需将APIM的证书导入网关的信任库：

• 导出APIM证书：

  keytool -export -alias wso2carbon -file apim-cert.pem -keystore repository/resources/security/wso2carbon.jks
  

• 将证书导入网关信任库：

  keytool -import -alias apim-cert -file apim-cert.pem -keystore repository/resources/security/client-truststore.jks
  

4. 验证API的OAuth2配置 #

在