WSO2 API 管理器 oAuth2 Secret_token 验证服务问题

Question

我们已经安装了 WSO2 Api Manager，没有独立的身份服务器(身份嵌入 )。当我尝试使用curl命令使用OAuth2TokenValidationService检查oAuth2用户access_token时:

curl --user apivalidatekey:apivalidatekey --header "Content-Type: text/xml" -k -d @soap.xml https://localhost:8243/services/OAuth2TokenValidationService/

soap.xml 所在位置:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
 xmlns:xsd="http://org.apache.axis2/xsd"
 xmlns:xsd1="http://dto.oauth2.identity.carbon.wso2.org/xsd">
 <soapenv:Header/>
  <soapenv:Body>
  <xsd:validate>
     <!--Optional:-->
     <xsd:validationReqDTO>
        <!--Optional:-->
        <xsd1:accessToken>691e72a68e2f0e0c07a4236c14c485</xsd1:accessToken>
        <!--Optional:-->
        <xsd1:tokenType>bearer</xsd1:tokenType>
     </xsd:validationReqDTO>
  </xsd:validate>
</soapenv:Body>
</soapenv:Envelope>

我在 wso2carbon.log 中的 API Manager 主机上遇到错误:

TID: [0] [AM] [2014-02-05 14:19:03,945] ERROR {java.lang.Class} -  System failure.null {java.lang.Class}
java.lang.NullPointerException
at org.wso2.carbon.server.admin.module.handler.AuthorizationHandler.doAuthorization(AuthorizationHandler.java:105)
at org.wso2.carbon.server.admin.module.handler.AuthorizationHandler.invoke(AuthorizationHandler.java:88)
at org.apache.axis2.engine.Phase.invokeHandler(Phase.java:340)
at org.apache.axis2.engine.Phase.invoke(Phase.java:313)
at org.apache.axis2.engine.AxisEngine.invoke(AxisEngine.java:261)
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:167)
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:404)
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:184)
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:744)

问题是什么，嵌入式IS是否支持这样的Web服务，因为我可以获得它的wsdl:

wget --no-check-certificate https://localhost:9443/services/OAuth2TokenValidationService?wsdl

Answer 1

“OAuth2TokenValidationService”是一项 protected 管理服务。因此，要调用此服务，您必须在基本身份验证 header 中发送特权用户凭据。但您发送的 api key 和 secret 似乎无效。您能否尝试在基本身份验证 header 中发送默认管理员用户凭据(即“admin”“admin”)并查看。

curl --user admin:admin --header "Content-Type: text/xml" --header "SOAPAction: validate" -k -d @soap.xml https://localhost:9443/services/OAuth2TokenValidationService/