WSO2 APIM 2.0 Clustering deployment issue when generate access token

Question

I deployed 2 keymanager nodes, 2 pub-store nodes, 1 gateway manager node and 2 gateway worker nodes in one server, and deployed nginx for load balance. When i try to generate the application access token, it reported below error:

2016-08-29 03:10:59,558 [-] [http-nio-9443-exec-5] ERROR subscription-add:jag org.jaggeryjs.scriptengine.exceptions.ScriptException: Error while obtaining the application access token for the application:DefaultApplication
2016-08-29 03:29:37,439 [-] [http-nio-9443-exec-45] ERROR AMDefaultKeyManagerImpl Error while creating tokens - sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:533)
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:401)
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:178)
    at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144)
    at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:131)
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610)
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445)
    at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:106)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:57)
    at org.wso2.carbon.apimgt.impl.AMDefaultKeyManagerImpl.getNewApplicationAccessToken(AMDefaultKeyManagerImpl.java:360)
    at org.wso2.carbon.apimgt.impl.APIConsumerImpl.renewAccessToken(APIConsumerImpl.java:867)
    at org.wso2.carbon.apimgt.impl.UserAwareAPIConsumer.renewAccessToken(UserAwareAPIConsumer.java:36)
    at org.wso2.carbon.apimgt.hostobjects.APIStoreHostObject.jsFunction_refreshToken(APIStoreHostObject.java:4120)
...
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491)
    ... 90 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)

and in pub-store nodes, i used WSClient for key validation and used

<AuthManager>
    <!-- Server URL of the Authentication service -->
    <ServerURL>https://km.devzone.com/services/</ServerURL>
    <!-- Admin username for the Authentication manager. -->
    <Username>${admin.username}</Username>
    <!-- Admin password for the Authentication manager. -->
    <Password>${admin.password}</Password>
    <!-- Indicates whether the permissions checking of the user (on the Publisher and Store) should be done
       via a remote service. The check will be done on the local server when false. -->
    <CheckPermissionsRemotely>false</CheckPermissionsRemotely>
</AuthManager>

What's the possible config issue?

score 0 · Accepted Answer · answered Aug 29 '16 at 08:20

0

This happen when you don't have keymanger certificate in store trust store. To fix this, export public certificate from Keymanager node's jks file, and import it to client-truststore.jks of store node.

answered Aug 29 '16 at 08:20

Bee

12,251
11
46
73

After i imported the certificate, it report "TID: [-1234] [] [2016-08-29 05:19:07,759] INFO {org.wso2.carbon.core.internal.permission.update.PermissionUpdater} - Permission cache updated for tenant -1234 {org.wso2.carbon.core.internal.permission.update.PermissionUpdater} TID: [-1234] [] [2016-08-29 05:19:19,471] ERROR {JAGGERY.site.blocks.subscription.subscription-add.ajax.subscription-add:jag} - java.lang.RuntimeException: Error occurred while calling token endpoint: HTTP error code : 500 {JAGGERY.site.blocks.subscription.subscription-add.ajax.subscription-add:jag} " – Emman Sun Aug 29 '16 at 10:00
my store access token generator from store page: "curl -k -d "grant_type=password&username=Username&password=Password" -H "Authorization: Basic VFVQeHFJTTlHWjNEX0wxNU9FdTFjbzNScTdFYTpxZHZqZnBzdGRtMU0yWU5lYTYxZlZTamFmTzhh" https://api.devzone.cs.com/token " . where https://api.devzone.cs.com/ is my gateway work node's load balance URL. And i can't find detail error log from pub-store's logs. – Emman Sun Aug 29 '16 at 10:03
1

I found the error log from gateway work node, it also needs to import certificate to gateway node's client-truststore.jks. thx! – Emman Sun Aug 29 '16 at 10:15

WSO2 APIM 2.0 Clustering deployment issue when generate access token

1 Answers1