Question

我正在使用SAML2 Bearer断言配置文件从WSO2 API Manager获取OAuth令牌。我有两个客户端应用程序。在OAuth令牌撤销过程中，我使用以下代码，

public static boolean revokeToken(Token token) throws IOException {
    //Create connection to the Token endpoint of API manger
    URL url = new URL(Config.apiMangerOAuthRevokeURL);

    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
    connection.setRequestMethod("POST");
    connection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded;charset=UTF-8");

    String userCredentials = Config.apiMangerClientID+":"+ Config.apiMangerClientSecret;
    String basicAuth = "Basic " + new String(Base64.encodeBytes(userCredentials.getBytes()));
    basicAuth = basicAuth.replaceAll("\\r|\\n", "");

    // Set the consumer-key and Consumer-secret
    connection.setRequestProperty("Authorization", basicAuth);
    connection.setUseCaches(false);
    connection.setDoInput(true);
    connection.setDoOutput(true);

    //Send request
    DataOutputStream wr = new DataOutputStream(connection.getOutputStream());
    wr.writeBytes("token="+token.getAccess_token());
    wr.flush();
    wr.close();

    //Get Response
    InputStream iss = connection.getInputStream();
    BufferedReader rd = new BufferedReader(new InputStreamReader(iss));

    String line;
    StringBuffer responseString = new StringBuffer();
    while ((line = rd.readLine()) != null) {
        responseString.append(line);
        responseString.append('\r');
    }

    rd.close();

    System.out.println("Revoking Token Mobile-"+token.getAccess_token());
    System.out.println("Revoking Response Mobile -"+responseString.toString());

    return true
            ;
}

一个客户端应用程序执行撤销过程确定。我在撤销后尝试使用CURL调用API，它按预期失败。但使用相同逻辑撤销令牌的其他客户端应用程序返回良好。但令牌在撤销后有效。我可以使用CURL来查询API。这里出了什么问题？

Answer 1

API Manager默认启用缓存，设置为15分钟。尝试禁用它。

API Manager OAuth令牌撤销是有问题的

1 个答案: