Question

我们正在使用WSO2 API Manager 2.5版和Identity Server 5.6，其中IS是API Manager的密钥管理器。

我在IS配置中启用了JWT。添加了具有用户标识和角色的自定义声明方言（因为我们不需要本地声明所包含的所有内容，并且由于标头太大，会导致后端出现错误）

当我调用API时，将生成并传递JWT。但是-角色声明在我的自定义方言中不起作用。当我将本地声明方言用于JWT时，角色包含在令牌中。

我的配置：

 <JWTConfiguration>
    <JWTHeader>X-JWT-Assertion</JWTHeader
    <JWTGeneratorImpl>org.wso2.carbon.apimgt.keymgt.token.JWTGenerator</JWTGeneratorImpl>
    <ClaimsRetrieverImplClass>org.wso2.carbon.apimgt.impl.token.DefaultClaimsRetriever</ClaimsRetrieverImplClass>
    <ConsumerDialectURI>http://ourdomain.com/jwt</ConsumerDialectURI>
    <SignatureAlgorithm>SHA256withRSA</SignatureAlgorithm>
    <EnableJWTGeneration>true</EnableJWTGeneration>
</JWTConfiguration>

http://ourdomain.com/jwt的方言如下：

http://ourdomain.com/jwt/uid
    Claim URI   http://ourdomain.com/jwt/uid
    Mapped Local Claim  http://wso2.org/claims/our/uid
http://ourdomain.com/jwt/fullname
    Claim URI   http://ourdomain.com/jwt/fullname
    Mapped Local Claim  http://wso2.org/claims/fullname
http://ourdomain.com/jwt/accountNr
    Claim URI   http://ourdomain.com/jwt/accountNr
    Mapped Local Claim  http://wso2.org/claims/accountNr
http://ourdomain.com/jwt/role
    Claim URI   http://ourdomain.com/jwt/role
    Mapped Local Claim  http://wso2.org/claims/role

这是最终的JWT内容：

{
  "http://ourdomain.com/jwt/version": "1.0.0",
  "http://ourdomain.com/jwt/applicationid": "90",
  "http://ourdomain.com/jwt/keytype": "SANDBOX",
  "http://ourdomain.com/jwt/uid": "123",
  "http://ourdomain.com/jwt/enduser": "mail.address@ourdomain.com@carbon.super",
  "http://ourdomain.com/jwt/subscriber": "EXTERNAL/subscriber@ourdomain.com",
  "iss": "wso2.org/products/am",
  "http://ourdomain.com/jwt/fullname": "Mail Address",
  "http://ourdomain.com/jwt/applicationtier": "Unlimited",
  "http://ourdomain.com/jwt/applicationname": "application",
  "http://ourdomain.com/jwt/enduserTenantId": "-1234",
  "http://ourdomain.com/jwt/tier": "Unlimited",
  "http://ourdomain.com/jwt/usertype": "APPLICATION_USER",
  "http://ourdomain.com/jwt/accountNr": [
    "123451",
    "123452",
    "123453"
  ],
  "http://ourdomain.com/jwt/apicontext": "/heimdall/1.0.0",
  "exp": 1541605849
}

有人误导我了吗？我必须编写自定义令牌生成器吗？

WSO2 API JWT角色丢失

0 个答案: