justauth/JustAuth · critical · AuthException

${cause.message}

Error message

${cause.message}

What it means

AuthAlipayCertRequest's constructor wraps DefaultAlipayClient in a try/catch and rethrows AlipayApiException as AuthException(cause). This fires at request-construction time when the Alipay SDK rejects the AlipayConfig: malformed or unreadable certificate/key resources, wrong private-key format, or incompatible gateway URL. The AuthException's message comes from the cause.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAlipayCertRequest.java:40

import me.zhyd.oauth.utils.UrlBuilder;

import static me.zhyd.oauth.config.AuthDefaultSource.ALIPAY;

/**
 * 支付宝证书模式登录
 *
 * @since 1.16.7
 */
public class AuthAlipayCertRequest extends AuthDefaultRequest {

    private final AlipayClient alipayClient;

    public AuthAlipayCertRequest(AuthConfig config, AlipayConfig alipayConfig) {
        super(config, ALIPAY);
        try {
            this.alipayClient = new DefaultAlipayClient(alipayConfig);
        } catch (AlipayApiException e) {
            throw new AuthException(e);
        }
    }

    @Override
    protected void checkCode(AuthCallback authCallback) {
        if (StringUtils.isEmpty(authCallback.getAuth_code())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CODE, source);
        }
    }

    @Override
    public AuthToken getAccessToken(AuthCallback authCallback) {
        AlipaySystemOauthTokenRequest request = new AlipaySystemOauthTokenRequest();
        request.setGrantType("authorization_code");
        request.setCode(authCallback.getAuth_code());
        AlipaySystemOauthTokenResponse response;
        try {
            response = this.alipayClient.certificateExecute(request);

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Read e.getCause() (AlipayApiException) — its message names exactly which resource/step failed.
2. Verify all certificate paths and the private key in AlipayConfig are readable at runtime (packaged as classpath resources or absolute paths present in the container).
3. Confirm you are using certificate mode consistently: appCertPath, alipayPublicCertPath, rootCertPath all set, and the keys match the open-platform app; use PKCS8 for RSA2.
4. Test the AlipayConfig by executing a trivial AlipayClient call in a unit test before wiring into AuthAlipayCertRequest.

Example fix

// before
new AuthAlipayCertRequest(authConfig, alipayConfig); // cert paths missing in Docker -> AuthException(AlipayApiException)

// after
// load certs from classpath and verify before constructing
try (InputStream in = app.getResource("cert/appCertPublicKey.crt").getInputStream()) {
    Preconditions.checkNotNull(in, "app cert missing");
}
new AuthAlipayCertRequest(authConfig, alipayConfig);

for (String p : new String[]{alipayConfig.getAppCertPath(), alipayConfig.getAlipayPublicCertPath(), alipayConfig.getRootCertPath()}) {
    if (p == null || !new File(p).canRead()) throw new IllegalArgumentException("Alipay cert not readable: " + p);
}

try { new AuthAlipayCertRequest(config, alipayConfig); } catch (AuthException e) { throw new ConfigurationException("Alipay client init failed: " + (e.getCause() != null ? e.getCause().getMessage() : e.getMessage()), e); }

When it happens

Trigger: new AuthAlipayCertRequest(authConfig, alipayConfig) where alipayConfig points at certificate paths/contents the Alipay SDK cannot load (alipayPublicCertPath, appCertPath, rootCertPath, privateKey) or the gateway URL is malformed; file paths valid at build time but missing at runtime.

Common situations: Cert files not packaged into the jar/deployment (path works locally, fails in Docker); mixing public-key mode config with certificate mode; pasting the private key with headers/whitespace damage; wrong format (PKCS1 vs PKCS8) for the configured sign type.

Related errors

• 5005
• 5008
• ${subMsg}
• 5002
• 5006

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/c23a4bf32d5846a6. Report an issue: GitHub.