{"record":{"id":"991f1b5eb33616d5","repo":"iflytek/astron-agent","slug":"unable-to-sign-workflow-gateway-identity","errorCode":null,"errorMessage":"Unable to sign workflow gateway identity","messagePattern":"Unable to sign workflow gateway identity","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"console/backend/commons/src/main/java/com/iflytek/astron/console/commons/security/WorkflowGatewayIdentity.java","lineNumber":66,"sourceCode":"        String internalKey = WorkflowInternalApiKey.requireConfigured(configuredKey);\n        if (!POST.equals(method)\n                || !PUBLIC_WORKFLOW_PATHS.contains(path)\n                || StringUtils.isBlank(appId)\n                || appId.indexOf('\\r') >= 0\n                || appId.indexOf('\\n') >= 0\n                || epochSeconds < 0) {\n            throw new IllegalArgumentException(\"invalid workflow gateway identity\");\n        }\n        String payload = method + '\\n' + path + '\\n' + appId + '\\n' + epochSeconds;\n        try {\n            Mac mac = Mac.getInstance(HMAC_SHA_256);\n            mac.init(new SecretKeySpec(\n                    internalKey.getBytes(StandardCharsets.UTF_8), HMAC_SHA_256));\n            return HexFormat.of()\n                    .formatHex(\n                            mac.doFinal(payload.getBytes(StandardCharsets.UTF_8)));\n        } catch (GeneralSecurityException exception) {\n            throw new IllegalStateException(\n                    \"Unable to sign workflow gateway identity\", exception);\n        }\n    }\n}\n","sourceCodeStart":48,"sourceCodeEnd":71,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/commons/src/main/java/com/iflytek/astron/console/commons/security/WorkflowGatewayIdentity.java#L48-L71","documentation":"sign wraps JCE HMAC operations (Mac.getInstance/init/doFinal); if the JVM throws GeneralSecurityException — e.g. HMAC-SHA-256 unavailable, a bad key specification, or provider failure — it is rethrown as IllegalStateException(\"Unable to sign workflow gateway identity\"). This is an environment/JVM problem, not an input problem.","triggerScenarios":"JRE without an HMAC-SHA-256 provider (custom/restricted JVM, FIPS policy excluding the algorithm); invalid SecretKeySpec bytes; security provider misconfiguration in java.security.","commonSituations":"Running on hardened/FIPS JVMs where default algorithms are restricted; stripped-down container JREs; java.security file edited with removed providers.","solutions":["Verify the JVM supports HmacSHA256 (Mac via a standard provider like SunJCE)","Check java.security provider configuration and restore default providers","Pin a standard base image/JRE for the console backend containers","Catch IllegalStateException in the caller and fail the request with 500, alerting on JVM crypto issues"],"exampleFix":"// before\n// custom JRE without SunJCE / restricted crypto policy\nString sig = WorkflowGatewayIdentity.sign(\"POST\", path, appId, ts);\n// after\n// use a full JDK/JRE image with default providers (HmacSHA256 available)\nString sig = WorkflowGatewayIdentity.sign(\"POST\", path, appId, ts);","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { sig = WorkflowGatewayIdentity.sign(\"POST\", path, appId, ts); } catch (IllegalStateException e) { log.error(\"HMAC unavailable\", e); response.sendError(500); }","preventionTips":["Use standard JRE images (SunJCE present) for the backend","Avoid restricting providers/algorithms in java.security on hardened JVMs","Smoke-test HMAC-SHA-256 availability at startup"],"tags":["jvm","hmac","crypto","environment"],"backgroundTag":"internal-invariant-violation","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}