apache / apache/servicecomb-java-chassis
[BUG] - 服务间认证,消费方多实例时,服务方认证鉴权会失败
- Dominant language
- Java
- Stars
- 1.9k
- Forks
- 814
- Avg merge
- 8d 23h
- Merged PRs (30d)
- 1
Description
### Steps to Reproduce
1、ConsumerTokenManager 生成的逻辑中,token拼接使用的 applicationName 和 serviceName,但是用于签名的公私钥对是每个微服务实例生成的。
2、ProviderTokenManager 去取消费方微服务的公钥时,默认取的实例组中的 get(0) 对应的公钥,就会导致多消费实例时,其他消费方认证失败
### Expected Behavior
_No response_
### Servicecomb Version
3.3.0
### Additional Context
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reading the token-generation logic in ConsumerTokenManager and the consumer public-key lookup in ProviderTokenManager. Reproduce the failure with multiple consumer instances on ServiceComb 3.3.0 and trace how applicationName, serviceName, and instance-specific key pairs are used. Done means every consumer instance can authenticate and pass provider authorization successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, authorization, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100