WSO2 IS5.3.0与APIM2.1.0迁移后管理员登录失败求助

Let’s work through the login issues you’re facing after migrating from the older APIM/IS stack. I’ll break down the problems and give you actionable steps to fix them:

1. Fix the File Lock Warning First #

That Couldn't flush system prefs: java.util.prefs.BackingStoreException: Couldn't get file lock warning isn’t just noise—it can block WSO2 components from writing critical config data, which might be throwing off authentication. Here’s how to resolve it:

• Linux/macOS:
  • Head to the Java preferences folder (usually ~/.java/.userPrefs/ or /var/lib/java/.userPrefs/).
  • Look for files ending with .lock in WSO2-related subfolders and delete them.
  • Restart both your APIM and IS services. If the warning comes back, double-check that the user running WSO2 has full read/write access to this directory.
• Windows:
  • Open the Registry Editor and navigate to HKEY_CURRENT_USER\Software\JavaSoft\Prefs or HKEY_LOCAL_MACHINE\Software\JavaSoft\Prefs.
  • Clear out any WSO2-related locked entries, then restart your services.

2. Make Sure Admin Credentials Are Synced Between APIM and IS #

Since you’re using the pre-packaged IS with APIM, credential mismatches between the two are a top culprit for login failures post-migration:

• Check User Store Configs:
  • Open <APIM_HOME>/repository/conf/user-mgt.xml and <IS_HOME>/repository/conf/user-mgt.xml. Confirm both are pointing to the same user store (whether it’s the embedded H2 DB or your external LDAP/MySQL).
  • Verify the AdminUser section in both files uses the same username (admin) and that the credential is correct. For the default H2 setup, it should be admin—but if you migrated your DB, make sure the password hash in the user store matches what IS 5.3.0 expects.
• Validate DB Migration:
  • If you moved your user store DB from the older versions, ensure all user records (including admin) transferred properly.
  • Connect to your user store DB and run this query:

    SELECT UM_USER_NAME, UM_USER_PASSWORD FROM UM_USER WHERE UM_USER_NAME = 'admin';
    

  • IS 5.3.0 uses bcrypt for password hashing by default. If the hash here is from the older stack (which might have used SHA-256), you’ll need to either update the hash to a bcrypt version of admin or temporarily adjust the password digest algorithm in user-mgt.xml to match the old one so you can reset the password.

3. Verify Authentication Endpoint Setup #

Post-migration, it’s easy for APIM and IS to lose sync on authentication endpoints:

• Open <APIM_HOME>/repository/conf/identity/identity.xml and check that the IdentityProvider config points to your IS 5.3.0 instance’s correct endpoint.
• Make sure there are no URL mismatches (like using localhost vs. a fully qualified domain name that both components can reach) in the SSO and OAuth2 settings.

4. Reset the Admin Password (Last Resort) #

If you can’t confirm the admin password is valid, reset it either via the database or the Carbon console:

• Database Reset:
  1. Generate a bcrypt hash for admin (use a trusted online tool or WSO2’s built-in password generator).
  2. Update the UM_USER_PASSWORD field for the admin user in the UM_USER table with this new hash.
  3. Restart both services and try logging in again.

内容的提问来源于stack exchange，提问作者Janier