WSO2 APIM 3.2.0 Carbon控制台添加JDBC二级用户存储报403错误

• 产品版本：WSO2 API Manager 3.2.0
• 错误现象：Carbon控制台创建JDBC二级用户存储时浏览器返回403 Forbidden，数据库连接测试功能显示连接状态正常
• 错误截图：

错误日志 #

TID: [-1] [] [2021-11-03 11:50:08,103] ERROR {org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve} - Could not handle request: null java.lang.NullPointerException
        at org.wso2.carbon.tomcat.ext.internal.Utils.getTenantDomain(Utils.java:41)
        at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.initCarbonContext(CarbonContextCreatorValve.java:79)
        at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:56)
        at org.wso2.carbon.tomcat.ext.valves.RequestCorrelationIdValve.invoke(RequestCorrelationIdValve.java:119)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:367)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1639)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:748)

运行环境 #

• 操作系统：Linux
• 数据库：MariaDB
• 用户存储类型：JDBC

现有deployment.toml配置 #

[server]
hostname = "<hostname>"
node_ip = "<ip>"
#offset=0
mode = "single" #single or ha
base_path = "${carbon.protocol}://${carbon.host}:${carbon.management.port}"
#discard_empty_caches = false
server_role = "default"

[super_admin]
username = "admin"
password = "<new_password>"
create_admin_account = true

[user_store]
type = "database_unique_id"

[database.apim_db]
type = "mysql"
url = "jdbc:mysql://<ip>:3306/am_db"
username = "<username>"
password = "<password>"

[database.shared_db]
type = "mysql"
url = "jdbc:mysql://<ip>:3306/reg_db"
username = "<username>"
password = "<password>"

该空指针错误是WSO2 API Manager 3.2.0版本的已知缺陷，由租户域名解析逻辑缺失导致，可按以下步骤修复：

1. 修改deployment.toml配置，在[tomcat]配置段下添加特殊请求路径的跳过规则，避免Carbon上下文校验拦截合法的用户存储配置请求：

[tomcat]
carbon_context_skip_pattern = ".*/carbon/.*\\.jsp\\?.*userStoreConfig.*"

2. 添加JDBC用户存储驱动适配配置（针对MariaDB兼容），在配置文件末尾追加：

[user_store_mgt]
allowed_user_stores = ["org.wso2.carbon.user.core.jdbc.UniqueIDJDBCUserStoreManager"]

3. 重启WSO2 API Manager服务，重新登录Carbon控制台创建JDBC二级用户存储即可。

如果上述配置修改后仍有问题，可直接通过配置文件方式声明二级用户存储，避免通过控制台交互触发校验缺陷：

[[user_store]]
type = "database_unique_id"
id = "JDBC_USER_STORE_01"
description = "Secondary JDBC User Store"
properties.jdbcUrl = "jdbc:mysql://<mariadb_ip>:3306/<user_store_db>"
properties.username = "<db_username>"
properties.password = "<db_password>"
properties.driverName = "com.mysql.cj.jdbc.Driver"
properties.disabled = false

内容的提问来源于stack exchange，提问作者Lilan Mihiranga