iflytek/astron-agent · critical · IllegalStateException

Unable to sign workflow gateway identity

Error message

Unable to sign workflow gateway identity

What it means

sign wraps JCE HMAC operations (Mac.getInstance/init/doFinal); if the JVM throws GeneralSecurityException — e.g. HMAC-SHA-256 unavailable, a bad key specification, or provider failure — it is rethrown as IllegalStateException("Unable to sign workflow gateway identity"). This is an environment/JVM problem, not an input problem.

Solutions

1. Verify the JVM supports HmacSHA256 (Mac via a standard provider like SunJCE)
2. Check java.security provider configuration and restore default providers
3. Pin a standard base image/JRE for the console backend containers
4. Catch IllegalStateException in the caller and fail the request with 500, alerting on JVM crypto issues

Example fix

// before
// custom JRE without SunJCE / restricted crypto policy
String sig = WorkflowGatewayIdentity.sign("POST", path, appId, ts);
// after
// use a full JDK/JRE image with default providers (HmacSHA256 available)
String sig = WorkflowGatewayIdentity.sign("POST", path, appId, ts);

try { sig = WorkflowGatewayIdentity.sign("POST", path, appId, ts); } catch (IllegalStateException e) { log.error("HMAC unavailable", e); response.sendError(500); }

When it happens

Trigger: JRE without an HMAC-SHA-256 provider (custom/restricted JVM, FIPS policy excluding the algorithm); invalid SecretKeySpec bytes; security provider misconfiguration in java.security.

Common situations: Running on hardened/FIPS JVMs where default algorithms are restricted; stripped-down container JREs; java.security file edited with removed providers.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• invalid workflow gateway identity
• MODEL_APIKEY_LOAD_ERROR
• Failed to build authentication URL
• Invalid host URL or authentication parameters
• -40003

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/991f1b5eb33616d5. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/commons/src/main/java/com/iflytek/astron/console/commons/security/WorkflowGatewayIdentity.java:66

        String internalKey = WorkflowInternalApiKey.requireConfigured(configuredKey);
        if (!POST.equals(method)
                || !PUBLIC_WORKFLOW_PATHS.contains(path)
                || StringUtils.isBlank(appId)
                || appId.indexOf('\r') >= 0
                || appId.indexOf('\n') >= 0
                || epochSeconds < 0) {
            throw new IllegalArgumentException("invalid workflow gateway identity");
        }
        String payload = method + '\n' + path + '\n' + appId + '\n' + epochSeconds;
        try {
            Mac mac = Mac.getInstance(HMAC_SHA_256);
            mac.init(new SecretKeySpec(
                    internalKey.getBytes(StandardCharsets.UTF_8), HMAC_SHA_256));
            return HexFormat.of()
                    .formatHex(
                            mac.doFinal(payload.getBytes(StandardCharsets.UTF_8)));
        } catch (GeneralSecurityException exception) {
            throw new IllegalStateException(
                    "Unable to sign workflow gateway identity", exception);
        }
    }
}

View on GitHub (pinned to 5e758547a8)