apache / apache/servicecomb-java-chassis

[BUG] - 服务间认证,消费方多实例时,服务方认证鉴权会失败

Open
#5,139 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
1.9k
Forks
814
Avg merge
8d 23h
Merged PRs (30d)
1

Description

### Steps to Reproduce

1、ConsumerTokenManager 生成的逻辑中,token拼接使用的 applicationName 和 serviceName,但是用于签名的公私钥对是每个微服务实例生成的。

2、ProviderTokenManager 去取消费方微服务的公钥时,默认取的实例组中的 get(0) 对应的公钥,就会导致多消费实例时,其他消费方认证失败

### Expected Behavior

_No response_

### Servicecomb Version

3.3.0

### Additional Context

_No response_

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reading the token-generation logic in ConsumerTokenManager and the consumer public-key lookup in ProviderTokenManager. Reproduce the failure with multiple consumer instances on ServiceComb 3.3.0 and trace how applicationName, serviceName, and instance-specific key pairs are used. Done means every consumer instance can authenticate and pass provider authorization successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.