Vert.x 4.3.3集成Keycloak 19.0.1 SSO遇RSA-OAEP算法异常求助

在Vert.x 4.3.3中使用Keycloak 19.0.1实现单点登录（SSO）时，触发以下异常：

Sep 09, 2022 11:52:03 AM io.vertx.ext.auth.oauth2.impl.OAuth2AuthProviderImpl
WARNING: Unsupported JWK
java.lang.RuntimeException: java.security.NoSuchAlgorithmException: RSA-OAEP
at io.vertx.ext.auth.impl.jose.JWK.(JWK.java:464)
at io.vertx.ext.auth.oauth2.impl.OAuth2AuthProviderImpl.lambda$jWKSet$2(OAuth2AuthProviderImpl.java:129)
at io.vertx.core.impl.future.Composition.onSuccess(Composition.java:38)
at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:60)
at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:211)
at io.vertx.core.impl.future.Composition$1.onSuccess(Composition.java:62)
at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:60)
at io.vertx.core.impl.future.SucceededFuture.addListener(SucceededFuture.java:88)
at io.vertx.core.impl.future.Composition.onSuccess(Composition.java:43)
at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:60)
at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:211)
at io.vertx.core.impl.future.Composition$1.onSuccess(Composition.java:62)
at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:60)
at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:211)
at io.vertx.core.impl.future.Composition$1.onSuccess(Composition.java:62)
at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:60)
at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:211)
at io.vertx.core.impl.future.Composition$1.onSuccess(Composition.java:62)
at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:60)
at io.vertx.core.impl.future.SucceededFuture.addListener(SucceededFuture.java:88)
at io.vertx.core.impl.future.Composition.onSuccess(Composition.java:43)
at io.vertx.core.impl.future.FutureBase.lambda$emitSuccess$0(FutureBase.java:54)
at io.vertx.core.impl.EventLoopContext.execute(EventLoopContext.java:86)
at io.vertx.core.impl.ContextBase.execute(ContextBase.java:225)
at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:51)
at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:211)
at io.vertx.core.impl.future.PromiseImpl.tryComplete(PromiseImpl.java:23)
at io.vertx.core.http.impl.HttpEventHandler.handleEnd(HttpEventHandler.java:79)
at io.vertx.core.http.impl.HttpClientResponseImpl.handleEnd(HttpClientResponseImpl.java:250)
at io.vertx.core.http.impl.Http1xClientConnection$StreamImpl.lambda$new$0(Http1xClientConnection.java:397)
at io.vertx.core.streams.impl.InboundBuffer.handleEvent(InboundBuffer.java:239)
at io.vertx.core.streams.impl.InboundBuffer.write(InboundBuffer.java:129)
at io.vertx.core.http.impl.Http1xClientConnection$StreamImpl.handleEnd(Http1xClientConnection.java:624)
at io.vertx.core.impl.EventLoopContext.execute(EventLoopContext.java:76)
at io.vertx.core.impl.ContextBase.execute(ContextBase.java:232)
at io.vertx.core.http.impl.Http1xClientConnection.handleResponseEnd(Http1xClientConnection.java:858)
at io.vertx.core.http.impl.Http1xClientConnection.handleHttpMessage(Http1xClientConnection.java:730)
at io.vertx.core.http.impl.Http1xClientConnection.handleMessage(Http1xClientConnection.java:694)
at io.vertx.core.net.impl.ConnectionBase.read(ConnectionBase.java:157)
at io.vertx.core.net.impl.VertxHandler.channelRead(VertxHandler.java:153)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
at io.netty.channel.CombinedChannelDuplexHandler$DelegatingChannelHandlerContext.fireChannelRead(CombinedChannelDuplexHandler.java:436)
at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:327)
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:299)
at io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:251)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166)
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:722)
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:658)
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:584)
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:496)
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: java.security.NoSuchAlgorithmException: RSA-OAEP
at io.vertx.ext.auth.impl.jose.JWK.(JWK.java:412)
... 62 more

问题原因 #

异常核心是JVM环境未提供RSA-OAEP加密算法支持，导致Vert.x解析Keycloak返回的JWK（JSON Web Key）时失败。

解决方法 #

1. 升级JDK版本 #

确保使用OpenJDK 11及以上版本，这类版本默认包含RSA-OAEP算法支持，旧版JDK可能未预装该算法。

2. 引入BouncyCastle安全提供者 #

若JDK默认不支持，可通过引入BouncyCastle库补充算法支持：

• Maven依赖：

  <dependency>
      <groupId>org.bouncycastle</groupId>
      <artifactId>bcprov-jdk15on</artifactId>
      <version>1.70</version>
  </dependency>
  

• 注册安全提供者：在Vert.x启动代码中添加：

  import org.bouncycastle.jce.provider.BouncyCastleProvider;
  import java.security.Security;
  
  public class MainVerticle extends AbstractVerticle {
      @Override
      public void start() {
          Security.addProvider(new BouncyCastleProvider());
          // 其他SSO初始化逻辑
      }
  }
  

3. 修改Keycloak密钥算法配置 #

登录Keycloak管理控制台，进入目标Realm的Keys页面，将密钥算法切换为Vert.x原生支持的RS256（RSA-SHA256），避免使用RSA-OAEP算法。

内容的提问来源于stack exchange，提问作者Vasu Sethia