WSO2独立网关API无法认证问题求助（附测试详情）

Let’s dive into why your gateway nodes are throwing that 900900 Unclassified Authentication Failure when using ThriftClient, and walk through actionable fixes tailored to your setup.

Key Context from Your Environment #

First, let’s anchor our troubleshooting on the critical details you shared:

• 3 nodes running on the same machine: 1 manager, 2 gateways, all sharing an embedded H2 database
• ThriftServer is enabled only on the manager; gateways use ThriftClient with EnableThriftServer=false
• Switching to WSClient works, so core API management and database connectivity are functional—this narrows the issue to Thrift-specific communication or configuration

Likely Causes & Step-by-Step Fixes #

1. Thrift Port/Host Reachability Issues #

Even on the same machine, gateway nodes might struggle to reach the manager’s Thrift server due to:

• Incorrect port binding: The manager’s ThriftServer might not be listening on port 10397 or the right network interface.
  • Verify the manager is listening on 10397: Run this command on your server:

    netstat -tulpn | grep 10397
    

    You should see the WSO2 Java process bound to either apimanager.example.com’s IP or 0.0.0.0 (all interfaces).
• Domain resolution problems: If apimanager.example.com isn’t mapped to your local machine’s IP in /etc/hosts, the gateway might try to reach an external address.
  • Edit /etc/hosts to add:

    127.0.0.1 apimanager.example.com
    

    Then restart your gateway nodes.
• Firewall/iptables blocking the port: Local traffic can still be blocked if iptables rules restrict port 10397.
  • Test connectivity from a gateway node:

    nc -zv apimanager.example.com 10397
    

    If it fails, add an iptables rule to allow traffic on 10397, or temporarily disable iptables to confirm the block.

2. Unresolved Credential Variables in Gateway Configs #

Your gateway nodes might be using unexpanded ${admin.username}/${admin.password} variables instead of actual admin credentials, leading to failed Thrift authentication:

• Open the gateway’s repository/conf/api-manager.xml and check the <APIKeyValidator> section. Replace the variables with your actual admin credentials (e.g., Username="admin" and Password="your-admin-password").
• Restart the gateway nodes after updating the config.

3. Embedded H2 Database Concurrency Limitations #

Shared embedded H2 databases can cause file locks or connection issues in multi-node setups, which might interfere with Thrift’s authentication flow (even if WSClient works):

• Switch H2 to server mode instead of embedded:
  1. Update master-datasources.xml in all nodes to use a server-mode JDBC URL. Replace the existing H2 URL with:

     <url>jdbc:h2:tcp://localhost/~/WSO2AM_DB;DB_CLOSE_ON_EXIT=FALSE;LOCK_TIMEOUT=60000</url>
     

  2. Start the H2 server manually (use the script at WSO2AM-2.1.0/bin/h2.sh or run the H2 jar directly).
  3. Restart all WSO2 nodes.

4. Thrift-Specific Debugging (Workaround for Known Bug) #

Even if you mentioned a bug preventing full debug mode, try enabling Thrift-specific logging to get more granular errors:

• Edit repository/conf/log4j.properties in the manager node and add:

  log4j.logger.org.wso2.carbon.apimgt.keymgt.thrift=DEBUG
  

• Restart the manager, reproduce the error, and check wso2carbon.log for details like invalid credentials or connection timeouts.

Final Notes #

If none of the above fixes work, keep in mind that WSO2 AM 2.1.0 has several known ThriftClient bugs in multi-node setups. Since switching to WSClient resolves your issue, that’s a solid temporary workaround. If you must use Thrift, consider upgrading to a newer WSO2 AM version (like 2.6.0 or later) where many Thrift-related issues are patched.

内容的提问来源于stack exchange，提问作者Sourcerer