我正在尝试配置 App ID 和 tWAS 之间的集成。我遵循了 App ID 服务的“概述”，并使用提供的示例成功配置了 Liberty，但相同的配置对于 tWAS 失败。我已经做了什么：
使用以下道具配置 TAI：
provider_1.identifier=app-idp provider_1.clientId=xxx provider_1.clientSecret=zzz provider_1.authorizeEndpointUrl=https://eu-gb.appid.cloud.ibm.com/... provider_1.tokenEndpointUrl=https://eu-gb.appid.cloud.ibm.com/oauth/... provider_1.signatureAlgorithm=RS256 provider_1.jwkEndpointUrl= https://eu-gb.appid.cloud.ibm.com/oauth/... provider_1.interceptedPathFilter=/appContext provider_1.redirectToRPHostAndPort=https://host:443 provider_1.tokenEndpointAuthMethod=basic provider_1.issuerIdentifier=https://eu-gb.appid.cloud.ibm.com/oauth...安装的 OIDCRP
当我尝试登录时，我被正确重定向到 App ID 登录页面，但在我提供凭据后，它会重定向并显示 403 Forbidden。
这是堆栈跟踪，任何提示可能是错误的或我错过了什么？
[4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU < getSecuredConnection returns [not null] Exit
[4/17/19 16:51:28:016 UTC] 000000bf SessionCache 3 getOpServerConnTimeout returns [20000])
[4/17/19 16:51:28:016 UTC] 000000bf RelyingParty 3 getRevokeEndpoint returns [null]
[4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU 3 isRevokeEndpoint[false]
[4/17/19 16:51:28:016 UTC] 000000bf RelyingParty 3 getTokenEndpointAuthMethod returns [basic]
[4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU 3 Setting [Authorization] property on request with basicauth info
[4/17/19 16:51:28:016 UTC] 000000bf RelyingParty 3 getClientBasicAuth returns [Basic OGExZmM2NjQtYTY3Zi00YTk4LWJmM2YtN2E0N2FmYjE4NTdlOk5XTmhaVGN5TVRFdFlUbGhaaTAwTlRkbUxXRTNOemd0TVdSa1lXVTVNelkxTXpWaw==]
[4/17/19 16:51:28:105 UTC] 000000bf RelyingPartyU 3 Response code: 403
[4/17/19 16:51:28:105 UTC] 000000bf RelyingPartyU > getData(inStream[not null]) Entry
[4/17/19 16:51:28:108 UTC] 000000bf RelyingPartyU < getData returns [<!DOCTYPE html>
....
[4/17/19 16:51:28:110 UTC] 000000bf RelyingParty E CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
[4/17/19 16:51:28:111 UTC] 000000bf WebAuthentica E SECJ0126E: Trust Association failed during validation. The exception is com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:526)
at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:301)
at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
at com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(WebAuthenticator.java:438)
at com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthenticator.java:3103)
at com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectIfNeeded(WebCollaborator.java:3522)
at com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborator.java:851)
at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebCollaborator.java:447)
at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preInvokeCollaborators(CollaboratorHelper.java:436)
at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1091)
at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4217)
at com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppImpl.java:2208)
at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:304)
at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1030)
at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1187)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:694)
at com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1833)
at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
. Make sure that the setup is correct and that the user credentials are valid.
[4/17/19 16:51:28:116 UTC] 000000bf WebCollaborat A SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
还尝试将身份验证方法更改为
provider_1.tokenEndpointAuthMethod=post
但结果相同，附加来自调用trace1.txt的完整跟踪
更新
在您的更改和我在设置中所做的一些更改之后，我进一步移动了。我已将此设置重置为基本
provider_1.tokenEndpointAuthMethod=Basic
现在错误是：
[4/18/19 12:07:58:638 UTC] 000000a6 WebCollaborat A SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]]. Check the logs for details that lead to this exception.
跟踪显示：
[4/18/19 12:07:58:614 UTC] 000000a6 JWT E CWWKS1756E: Validation failed for the ID token requested by [....] using the [RS256] algorithm due to a signature verification failure: [JsonObject].
[4/18/19 12:07:58:617 UTC] 000000a6 SessionData 3 Failed to validate id token, exception thrown during verify [JsonObject]
[4/18/19 12:07:58:629 UTC] 000000a6 WebAuthentica E SECJ0126E: Trust Association failed during validation. The exception is com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]]. Check the logs for details that lead to this exception.
at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:532)
at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:301)
at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
at com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(WebAuthenticator.java:438)
at com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthenticator.java:3171)
at com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectIfNeeded(WebCollaborator.java:3522)
at com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborator.java:851)
at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebCollaborator.java:447)
at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preInvokeCollaborators(CollaboratorHelper.java:436)
at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1091)
at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4217)
at com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppImpl.java:2208)
at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:304)
at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1030)
at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1187)
at com.ibm.ws.ssl.channel.impl.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:694)
at com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1833)
at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
Caused by: com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]
at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:483)
at com.ibm.ws.security.oidc.client.SessionData.processJSON(SessionData.java:236)
at com.ibm.ws.security.oidc.client.SessionData.createData(SessionData.java:166)
at com.ibm.ws.security.oidc.client.SessionData.<init>(SessionData.java:137)
at com.ibm.ws.security.oidc.client.SessionCache.createEntry(SessionCache.java:184)
at com.ibm.ws.security.oidc.client.RelyingPartyUtils.createSessionDataObject(RelyingPartyUtils.java:1299)
at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:529)
... 31 more
Caused by: java.lang.UnsupportedOperationException: JsonObject
at com.google.gson.JsonElement.getAsString(JsonElement.java:191)
at com.ibm.ws.security.openidconnect.token.JsonTokenUtil.fromJsonToken(JsonTokenUtil.java:154)
at com.ibm.ws.security.openidconnect.token.JWT.fromJsonToken(JWT.java:553)
at com.ibm.ws.security.openidconnect.token.JWT.verify(JWT.java:886)
at com.ibm.ws.security.openidconnect.token.IDToken.verify(IDToken.java:578)
at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:471)
... 37 more