【发布时间】：2021-01-06 00:47:07
【问题描述】：
我正在尝试使用密码和客户端凭据方法从 WSO2 令牌端点生成 JWT，但未发现子声明值的差异。它总是只指向用户 ID，它不应该在使用客户端凭据方法生成的 JWT 的子声明中包含应用程序 ID/客户端 ID 吗？
例如：
- 使用密码授权获得的令牌：
请求：
POST https://localhost:8243/token HTTP/1.1
内容类型：application/x-www-form-urlencoded
授权：基本
UnNOYWY5ams2MERCM2tXQ292ZGZEZnRTWklvYToxU1o0alg1bW5YV2lBT3BkYjRReFhmS09VN1lh
主机：本地主机：8243
内容长度：53
grant_type=password&username=api3dev&password=api3dev
JWT 响应 {"typ":"JWT","alg":"RS256","x5t":"NTdmZjM4ZDk3NjY0Yzc5MmZmODgwMTE3MWYwNDE5MWRlZDg4Nzc4ZA=="} {"aud":"http://org.wso2.apimgt/gateway","sub":"api3dev@carbon.super","application":{"owner":"api2dev" ,"tierQuotaType":"requestCount","tier":"Unlimited","name":"demoapp_oriKeymgr","id":68,"uuid":null},"scope":"default","iss": "https://localhost:9443/oauth2/token","tierInfo":{"Unlimited":{"tierQuotaType":"requestCount","stopOnQuotaReach":true,"spikeArrestLimit":0,"spikeArrestUnit":null} },"keytype":"PRODUCTION","subscribedAPIs":[{"subscriberTenantDomain":"carbon.super","name":"PizzaShackAPI","context":"/pizzashack/1.0.0","publisher" :"admin","version":"1.0.0","subscriptionTier":"Unlimited"}],"consumerKey":"RsNaf9jk60DB3kWCovdfDftSZIoa","exp":1600502664,"iat":1600499064,"jti":" 426d64a9-932b-4f0c-b396-202fd03dd960"}
- 使用客户端凭据获取的令牌：
请求：
POST https://localhost:8243/token HTTP/1.1
内容类型：application/x-www-form-urlencoded
授权：基本 UnNOYWY5ams2MERCM2tXQ292ZGZEZnRTWklvYToxU1o0alg1bW5YV2lBT3BkYjRReFhmS09VN1lh
主机：本地主机：8243
内容长度：29
grant_type=client_credentials
JWT 响应 {"typ":"JWT","alg":"RS256","x5t":"NTdmZjM4ZDk3NjY0Yzc5MmZmODgwMTE3MWYwNDE5MWRlZDg4Nzc4ZA=="} {"aud":"http://org.wso2.apimgt/gateway","sub":"api2dev@carbon.super","application":{"owner":"api2dev" ,"tierQuotaType":"requestCount","tier":"Unlimited","name":"demoapp_oriKeymgr","id":68,"uuid":null},"scope":"am_application_scope default","iss" :"https://localhost:9443/oauth2/token","tierInfo":{"Unlimited":{"tierQuotaType":"requestCount","stopOnQuotaReach":true,"spikeArrestLimit":0,"spikeArrestUnit":null }},"keytype":"PRODUCTION","subscribedAPIs":[{"subscriberTenantDomain":"carbon.super","name":"PizzaShackAPI","context":"/pizzashack/1.0.0","publisher ":"admin","version":"1.0.0","subscriptionTier":"Unlimited"}],"consumerKey":"RsNaf9jk60DB3kWCovdfDftSZIoa","exp":1600502788,"iat":1600499188,"jti": "8091497e-9978-4541-99b9-efca50b16868"}
在上面的示例中，您可以看到子声明始终只有用户 ID。
【问题讨论】：
-
您使用的 API-M 版本是什么？是的，理想情况下，使用客户端凭据获得的令牌的子声明值应该是客户端 ID。在 API-M 3.2 中使用了 WSO2 IS 的 JWTTokenIssuer，因此这应该在 github.com/wso2-extensions/identity-inbound-auth-oauth 中修复。请创建一个 git 问题。