Fatal编程技术网
  • jwt/
  • JHipster microservice应用程序抛出无效JWT错误

JHipster microservice应用程序抛出无效JWT错误

jwt jhipster keycloak

JHipster microservice应用程序抛出无效JWT错误,jwt,jhipster,keycloak,Jwt,Jhipster,Keycloak,我正在尝试使用JWT身份验证连接到JHipster生成的微服务应用程序。我已经在jwt.io上验证了我的令牌和公钥，但是当我将我的公钥插入application-XXX.yml中服务的base64 secret参数时，我收到以下消息： inventory-app_1 | 2020-09-02 17:40:07.351 INFO 1 --- [ XNIO-1 task-1] xxxx.security.jwt.TokenProvider : Invalid JWT token. inv

我正在尝试使用JWT身份验证连接到JHipster生成的微服务应用程序。我已经在jwt.io上验证了我的令牌和公钥，但是当我将我的公钥插入application-XXX.yml中服务的base64 secret参数时，我收到以下消息：

inventory-app_1    | 2020-09-02 17:40:07.351  INFO 1 --- [  XNIO-1 task-1] xxxx.security.jwt.TokenProvider  : Invalid JWT token.
inventory-app_1    | 2020-09-02 17:40:07.384  WARN 1 --- [  XNIO-1 task-1] o.z.problem.spring.common.AdviceTraits   : Unauthorized: Full authentication is required to access this resource
我的令牌/密钥由KeyClope v7.0服务器使用RS256生成。我使用的公钥位于，键值为x5c

如果已知我的JWT/密钥对有效，那么哪些因素会阻止我的JHipster/spring服务器识别令牌

编辑：我能够提取以下错误消息：

对我来说，这个错误似乎表明不可能使用RS256签名令牌，但它并不完全清楚。

JHipster生成的JWT安全性只允许HMAC签名

The parsed JWT indicates it was signed with the RS256 signature algorithm, but the specified signing key of type j
avax.crypto.spec.SecretKeySpec may not be used to validate RS256 signatures.  Because the specified signing key reflects a specific and expected algorithm, and the JWT does not reflect this algorithm, it is likely that the JWT was n
ot expected and therefore should not be trusted.  Another possibility is that the parser was configured with the incorrect signing key, but this cannot be assumed for security reasons.