Wso2 APIM 多租户和 keycloak 集成

Question

我正在尝试在 wso2 中使用 keycloak 作为我的 IDP，并且在使用默认管理员用户（默认情况下 blong 到 carbon 域）时它工作正常，但是当尝试从属于使用创建的多租户域创建的不同域的用户获取身份验证令牌时，我我得到 403 forbidden。 Wso2 控制台错误

Caused by: feign.FeignException$Forbidden: [403 Forbidden] during [POST] to [http://localhost:8080/auth/realms/master/clients-registrations/openid-connect] [DCRClient#createApplication(ClientInfo)]: [{"error":"insufficient_scope","error_description":"Forbidden"}]
        at feign.FeignException.clientErrorStatus(FeignException.java:199) ~[io.github.openfeign.feign-core_11.0.0.jar:?]
        at feign.FeignException.errorStatus(FeignException.java:177) ~[io.github.openfeign.feign-core_11.0.0.jar:?]
        at feign.FeignException.errorStatus(FeignException.java:169) ~[io.github.openfeign.feign-core_11.0.0.jar:?]
        at feign.codec.ErrorDecoder$Default.decode(ErrorDecoder.java:92) ~[io.github.openfeign.feign-core_11.0.0.jar:?]
        at feign.AsyncResponseHandler.handleResponse(AsyncResponseHandler.java:96) ~[io.github.openfeign.feign-core_11.0.0.jar:?]
        at feign.SynchronousMethodHandler.executeAndDecode(SynchronousMethodHandler.java:138) ~[io.github.openfeign.feign-core_11.0.0.jar:?]
        at feign.SynchronousMethodHandler.invoke(SynchronousMethodHandler.java:89) ~[io.github.openfeign.feign-core_11.0.0.jar:?]
        at feign.ReflectiveFeign$FeignInvocationHandler.invoke(ReflectiveFeign.java:100) ~[io.github.openfeign.feign-core_11.0.0.jar:?]
        at com.sun.proxy.$Proxy496.createApplication(Unknown Source) ~[?:?]
        at org.wso2.keycloak.client.KeycloakClient.createApplication(KeycloakClient.java:134) ~[keycloak.key.manager_2.0.2.jar:?]
        at org.wso2.carbon.apimgt.impl.workflow.AbstractApplicationRegistrationWorkflowExecutor.dogenerateKeysForApplication_aroundBody8(AbstractApplicationRegistrationWorkflowExecutor.java:150) ~[org.wso2.carbon.apimgt.impl_6.7.206.jar:?]
        at org.wso2.carbon.apimgt.impl.workflow.AbstractApplicationRegistrationWorkflowExecutor.dogenerateKeysForApplication(AbstractApplicationRegistrationWorkflowExecutor.java:124) ~[org.wso2.carbon.apimgt.impl_6.7.206.jar:?]
        at org.wso2.carbon.apimgt.impl.workflow.AbstractApplicationRegistrationWorkflowExecutor.generateKeysForApplication_aroundBody6(AbstractApplicationRegistrationWorkflowExecutor.java:120) ~[org.wso2.carbon.apimgt.impl_6.7.206.jar:?]
        at org.wso2.carbon.apimgt.impl.workflow.AbstractApplicationRegistrationWorkflowExecutor.generateKeysForApplication(AbstractApplicationRegistrationWorkflowExecutor.java:117) ~[org.wso2.carbon.apimgt.impl_6.7.206.jar:?]
        at org.wso2.carbon.apimgt.impl.workflow.ApplicationRegistrationSimpleWorkflowExecutor.complete_aroundBody2(ApplicationRegistrationSimpleWorkflowExecutor.java:78) ~[org.wso2.carbon.apimgt.impl_6.7.206.jar:?]
        ... 59 more
[2021-01-20 11:21:43,158] ERROR - GlobalThrowableMapper org.wso2.carbon.apimgt.api.APIManagementException: org.wso2.carbon.apimgt.impl.workflow.WorkflowException: Error occurred while executing SubscriberKeyMgtClient.

Keycloak 控制台消息

11:20:35,757 WARN  [org.keycloak.events] (default task-16) type=CLIENT_REGISTER_ERROR, realmId=master, clientId=null, userId=null, ipAddress=127.0.0.1, error=not_allowed