wso2 IS 4.6 中有效令牌的 OAuth 验证失败

Question

我尝试通过使用 wso2 身份服务器 4.6 创建自定义处理程序来保护 rest API，即使对于有效令牌，它也会显示无效令牌。 (stub.validate(dto).getValid() always false) 但它在 IS 4.5 中运行良好。原因是什么？ 请帮忙..

登录 IS 4.6

[2013-12-31 09:38:21,625] DEBUG {org.wso2.carbon.identity.oauth2.OAuth2Service} -  Access Token Request Received with the Client Id : jjTDKDAThDSg_IroxfpC4qjPCR8a, Grant Type : password
[2013-12-31 09:38:21,625] DEBUG {org.wso2.carbon.identity.oauth2.util.OAuth2Util} -  Client credentials were available in the cache for client id : jjTDKDAThDSg_IroxfpC4qjPCR8a
[2013-12-31 09:38:21,626] DEBUG {org.wso2.carbon.identity.oauth2.util.OAuth2Util} -  Successfully authenticated the client with client id : jjTDKDAThDSg_IroxfpC4qjPCR8a
[2013-12-31 09:38:21,646] DEBUG {org.wso2.carbon.identity.oauth2.token.handlers.grant.PasswordGrantHandler} -  Token request with Password Grant Type received. Username : admin@carbon.superScope : , Authentication State : true
[2013-12-31 09:38:21,647] DEBUG {org.wso2.carbon.identity.oauth2.token.handlers.grant.AbstractAuthorizationGrantHandler} -  Access Token info retrieved from the cache and served to client with client id : jjTDKDAThDSg_IroxfpC4qjPCR8a
[2013-12-31 09:38:21,647] DEBUG {org.wso2.carbon.identity.oauth2.token.AccessTokenIssuer} -  Access Token issued to client. client-id=jjTDKDAThDSg_IroxfpC4qjPCR8a user-name=admin@carbon.super to application=sample
[2013-12-31 09:38:21,721]  INFO {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} -  'admin@carbon.super [-1234]' logged in at [2013-12-31
 09:38:21,721+0530]
[2013-12-31 09:38:21,723] DEBUG {org.wso2.carbon.identity.oauth2.validators.TokenValidationHandler} -  Access token identifier is not present in the validation request
[2013-12-31 09:38:21,740]  INFO {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} -  'admin@carbon.super [-1234]' logged in at [2013-12-31
 09:38:21,740+0530]
DEBUG {org.wso2.carbon.identity.oauth2.validators.TokenValidationHandler} -  Access token identifier is not present in the validation request

登录 IS 4.5

[2013-12-31 09:48:47,432] DEBUG {org.wso2.carbon.identity.oauth2.OAuth2Service}
-  Access Token Request Received with the Client Id : jjTDKDAThDSg_IroxfpC4qjPCR8a, Grant Type : password
[2013-12-31 09:48:47,442] DEBUG {org.wso2.carbon.identity.oauth2.util.OAuth2Util} -  Client credentials were available in the cache for client id : jjTDKDAThDSg_IroxfpC4qjPCR8a
[2013-12-31 09:48:47,442] DEBUG {org.wso2.carbon.identity.oauth2.util.OAuth2Util} -  Successfully authenticated the client with client id : jjTDKDAThDSg_IroxfpC4qjPCR8a
[2013-12-31 09:48:47,462] DEBUG {org.wso2.carbon.identity.oauth2.token.handlers.grant.PasswordGrantHandler} -  Token request with Password Grant Type received.
Username : admin@carbon.superScope : , Authentication State : true
[2013-12-31 09:48:47,462] DEBUG {org.wso2.carbon.identity.oauth2.token.handlers.grant.AbstractAuthorizationGrantHandler} -  Access Token info retrieved from the cache and served to client with client id : jjTDKDAThDSg_IroxfpC4qjPCR8a
[2013-12-31 09:48:47,462] DEBUG {org.wso2.carbon.identity.oauth2.token.AccessTokenIssuer} -  Access Token issued to client. client-id=jjTDKDAThDSg_IroxfpC4qjPCR8a user-name=admin@carbon.super to application=sample
[2013-12-31 09:48:47,582]  INFO {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} -  'admin@carbon.super [-1234]' logged in at [2013-12-31 09:48:47,582+0530]
[2013-12-31 09:48:47,582] DEBUG {org.wso2.carbon.identity.oauth2.OAuth2TokenValidationService} -  Token validation request received for : Client Id : nullTokenType : bearer
[2013-12-31 09:48:47,582] DEBUG {org.wso2.carbon.identity.oauth2.validators.BearerTokenValidator} -  Started processing token validation request of type : bearer
[2013-12-31 09:48:47,612]  INFO {org.wso2.carbon.core.services.util.CarbonAuthenticationUtil} -  'admin@carbon.super [-1234]' logged in at [2013-12-31 09:48:47,612+0530]
[2013-12-31 09:48:47,612] DEBUG {org.wso2.carbon.identity.oauth2.OAuth2TokenValidationService} -  Token validation request received for : Client Id : nullTokenType : bearer
[2013-12-31 09:48:47,612] DEBUG {org.wso2.carbon.identity.oauth2.validators.BearerTokenValidator} -  Started processing token validation request of type : bearer

Answer 1

我在通过 Oauth2 验证 Web 服务访问 Wso2 Identity Server 4.6.0 的 Wso2 ESB 4.8.0 中的 OAuth Mediator 遇到了同样的问题。使用 Identity server 4.5.0 可以正常工作。中介代码调用客户端存根，将 accessToken 作为纯字符串传递。

验证服务返回的错误信息是Access token identifier is not present in the validation request。

要回答您的问题，您应该使用 4.2.2 版中的捆绑包 org.wso2.carbon.identity.oauth.stub。它定义了一个类org.wso2.carbon.identity.oauth2.stub.dto.OAuth2TokenValidationRequestDTO_OAuth2AccessToken，它应该用作OAuth2TokenValidationRequestDTO.setAccessToken 方法的参数。 dto 对象可以用作OAuth2TokenValidationServiceStub.validate 方法的参数。

Answer 2

您可能知道，OAuth 访问令牌是通过在 Identity Server 中调用 OAuth2TokenValidationService Web 服务来验证的。您能否使用 SOAPUI 试用此服务并查看... 可以在 (https://{ip}:{port}/services/OAuth2TokenValidationService?wsdl) 找到 WSDL。通常，当发送到此服务的 Web 服务请求中不存在访问令牌时会生成此错误。

在请求消息正文中，必须如下..

        <xsd1:accessToken>
           <xsd1:identifier>35d1538940ce9a1e86c0a287c521d14</xsd1:identifier>
           <xsd1:tokenType>bearer</xsd1:tokenType>
        </xsd1:accessToken>

在您的代码中，“dto”对象可能没有正确设置标识符值。

另外，请从here 中找到示例 OAuth 令牌验证客户端代码