Patrik Wikström (Digia Finland Oy) asked a question.

August 6, 2025 at 12:52 PM
oemanager not working in at least 12.8.7 and 12.8.8?

Is there known problems using the oemanager.war in more recent 12.8.x versions?

We get the error:

2025-08-05T16:54:07.355+03:00 ERROR [thd-6] com.progress.appserv.manager.admin - [OeablServiceManagerRest] Error encountered while fetching service from OEABLService Manager. Cause Failed to load JWS keys (through reference chain: java.util.ArrayList[0]->com.progress.appserv.manager.entities.Application["webapps"]->java.util.ArrayList[3]->com.progress.appserv.manager.entities.WebApp["transports"]->java.util.ArrayList[0]->com.progress.appserv.manager.entities.OESecurityMgr["securityBeans"]->java.util.HashMap["jwkWebSelector"]->com.progress.appserv.services.security.jwt.OEWebKeySelector["jwskeys"]) 

 

We are using own scripts that setup PAS so it might be something that is related to that process also.

 

https://docs.progress.com/bundle/pas-for-openedge-reference/page/REST-API-Reference-for-oemanager.war.html

  • 5 answers
  • 243 views
Peter Judge and Toni Perätalo like this.

  • Rob Fitzpatrick (White Star Software)

    FWIW, I have used OEManager successfully in 12.8.7 and 12.8.8.

    • Patrik Wikström (Digia Finland Oy)

      Thanks for the info! We had urls defined in some properties for our jwt webapp and that caused this problem, now they are empty and everything seems to work.

      jwtToken.keystore.jwkurl=

      jwtToken.keystore.jwkIssuerUrl=

  • Toni Perätalo (Digia)

    In addition to @Patrik Wikström (Digia Finland Oy)​ 's comment, we had several webapps defined for different authentication methods and the above fix needed to be done to the one that was using jwt tokens for authentication, even it does not really use the urls for anything. Something must have been changed under the hood since 12.8.5 because with SP5 and previous versions everything worked fine even those parameters where left as they are by default:

    1. ## "jwk": URL path to Authorization Server's JWK distribution
    2. jwtToken.keystore.jwkurl=https://localhost:8881/path-to-jwk-set
    3.  
    4. ## "jwkissuer": URL path to Authorization Server's provider configuration url
    5. jwtToken.keystore.jwkIssuerUrl=https://idp.example.com

    Maybe the Tomcat version has been updated?

  • Patrik Wikström (Digia Finland Oy)

    Just to let you know, that solved the oemanager issue but prevented out jwt webapp to launch, we still have to investigate this when we have more time.

    • Patrik Wikström (Digia Finland Oy)

      We have a web application configured to use a JWT token, which is signed with a "fixed key" rather than a certificate.

      oeablSecurity.properties

      1. client.login.model=oauth2
      2. jwtToken.keystore.type=mac
      4. ## "mac": JWT Signature's mac secret-key phrase
      5. jwtToken.macKey=<removed>
      6. oauth2.resSvc.tokenServices=jwt
      7.  
      8. ## The JWT Signature algorithm used by the Authorization Server
      9. jwtToken.signatureAlg=HS256