title: API authentication failure due to Unclassified Authentication Failure with WSO2 IS-KM as Key manager in WSO2 API M
body: <p>Hello I am very much new to WSO2 products and exploring WSO2 API Manager 2.6.0 and WSO2 IS - KM 5.9.0. I am trying to use WSO2 IS -KM as key manager for WSO2 API M. I have followed all the steps mentioned in <a href="https://docs.wso2.com/display/AM260/Configuring+WSO2+Identity+Server+as+a+Key+Manager#ConfiguringWSO2IdentityServerasaKeyManager-Step1-DownloadWSO2ISasaKeyManager(WSO2IS-KM)" rel="nofollow noreferrer">https://docs.wso2.com/display/AM260/Configuring+WSO2+Identity+Server+as+a+Key+Manager#ConfiguringWSO2IdentityServerasaKeyManager-Step1-DownloadWSO2ISasaKeyManager(WSO2IS-KM)</a></p>
  
  <p>But I am getting the following error in API M carbon log when I try to call an API with generated token through API Manager.</p>
  
  <p>TID: [-1] [] [2019-11-04 16:51:40,484]  WARN {org.apache.synapse.transport.http.access.AccessConfiguration} -  Error loading properties from file: access-log.properties {org.apache.synapse.transport.http.access.AccessConfiguration}
  TID: [-1234] [] [2019-11-04 16:51:40,535]  INFO {org.apache.synapse.core.axis2.TimeoutHandler} -  This engine will expire all callbacks after GLOBAL_TIMEOUT: 120 seconds, irrespective of the timeout action, after the specified or optional timeout {org.apache.synapse.core.axis2.TimeoutHandler}
  TID: [-1234] [] [2019-11-04 16:52:52,019] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator} -  Received Token 403252b7-c890-38ce-add7-013eb510b1e3 {org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator}
  TID: [-1234] [] [2019-11-04 16:52:52,019] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator} -  Default Version API invoked {org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator}
  TID: [-1234] [] [2019-11-04 16:52:52,019] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator} -  Removing Authorization header from headers {org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator}
  TID: [-1234] [] [2019-11-04 16:52:52,020] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator} -  Resource not found in cache for key: /pocGet/1.0.0/1.0.0/getAllDDN:GET {org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator}
  TID: [-1234] [] [2019-11-04 16:52:52,020] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator} -  Setting REST_SUB_REQUEST_PATH in msg context: /getAllDDN {org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator}
  TID: [-1234] [] [2019-11-04 16:52:52,020] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator} -  Cache miss for Resource for key: /pocGet/1.0.0/1.0.0/getAllDDN:GET {org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator}
  TID: [-1234] [] [2019-11-04 16:52:52,021] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator} -  Could not find API object in cache for key: /pocGet/1.0.0/1.0.0 {org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator}
  TID: [-1234] [] [2019-11-04 16:52:52,022] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.keys.APIKeyValidatorClientPool} -  Initializing new APIKeyValidatorClient instance {org.wso2.carbon.apimgt.gateway.handlers.security.keys.APIKeyValidatorClientPool}
  TID: [-1234] [] [2019-11-04 16:52:52,032] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.keys.APIKeyValidatorClient} -  Get all URI templates request from gateway to keymanager via web service call for:/pocGet/1.0.0 at [2019.11.04 16:52:52,032 IST] {org.wso2.carbon.apimgt.gateway.handlers.security.keys.APIKeyValidatorClient}
  TID: [-1234] [] [2019-11-04 16:52:54,786] DEBUG {org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler} -  Call to Key Manager : API call failed reason=API_authentication_failure transactionId=urn:uuid:32a9f7d6-f642-4276-8452-637d65a01d61 with userAgent=PostmanRuntime/7.1.1 for requestURI=/pocGet/1.0.0/getAllDDN at time=Mon Nov 04 16:52:52 IST 2019 from clientIP=10.40.254.70, elapsedTimeInMilliseconds=0 {org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler}
  TID: [-1234] [] [2019-11-04 16:52:54,789] ERROR {org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler} -  API authentication failure due to Unclassified Authentication Failure {org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler}
  org.wso2.carbon.apimgt.gateway.handlers.security.APISecurityException: Error while accessing backend services for API key validation
          at org.wso2.carbon.apimgt.gateway.handlers.security.keys.WSAPIKeyDataStore.getAllURITemplates(WSAPIKeyDataStore.java:77)
          at org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator.getAllURITemplates(APIKeyValidator.java:791)
          at org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator.doGetAPIInfo(APIKeyValidator.java:639)
          at org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator.findMatchingVerb(APIKeyValidator.java:573)
          at org.wso2.carbon.apimgt.gateway.handlers.security.APIKeyValidator.getResourceAuthenticationScheme(APIKeyValidator.java:357)
          at org.wso2.carbon.apimgt.gateway.handlers.security.oauth.OAuthAuthenticator.authenticate(OAuthAuthenticator.java:127)
          at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.isAuthenticate(APIAuthenticationHandler.java:210)
          at org.wso2.carbon.apimgt.gateway.handlers.security.APIAuthenticationHandler.handleRequest(APIAuthenticationHandler.java:158)
          at org.apache.synapse.rest.API.process(API.java:325)
          at org.apache.synapse.rest.RESTRequestHandler.apiProcessNonDefaultStrategy(RESTRequestHandler.java:149)
          at org.apache.synapse.rest.RESTRequestHandler.dispatchToAPI(RESTRequestHandler.java:95)
          at org.apache.synapse.rest.RESTRequestHandler.process(RESTRequestHandler.java:71)
          at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:303)
          at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:92)
          at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180)
          at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:337)
          at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:158)
          at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
          at java.lang.Thread.run(Thread.java:748)
  Caused by: org.wso2.carbon.apimgt.gateway.handlers.security.APISecurityException: Error while accessing backend services for API key validation
          at org.wso2.carbon.apimgt.gateway.handlers.security.keys.APIKeyValidatorClient.getAllURITemplates(APIKeyValidatorClient.java:189)
          at org.wso2.carbon.apimgt.gateway.handlers.security.keys.WSAPIKeyDataStore.getAllURITemplates(WSAPIKeyDataStore.java:75)
          ... 20 more
  Caused by: org.apache.axis2.AxisFault: org.apache.axis2.databinding.ADBException: Unexpected subelement {<a href="http://model.api.apimgt.carbon.wso2.org/xsd" rel="nofollow noreferrer">http://model.api.apimgt.carbon.wso2.org/xsd</a>}id
          at org.apache.axis2.AxisFault.makeFault(AxisFault.java:430)
          at org.wso2.carbon.apimgt.keymgt.stub.validator.APIKeyValidationServiceStub.fromOM(APIKeyValidationServiceStub.java:1452)
          at org.wso2.carbon.apimgt.keymgt.stub.validator.APIKeyValidationServiceStub.getAllURITemplates(APIKeyValidationServiceStub.java:245)
          at org.wso2.carbon.apimgt.gateway.handlers.security.keys.APIKeyValidatorClient.getAllURITemplates(APIKeyValidatorClient.java:173)
          ... 21 more
  Caused by: java.lang.Exception: org.apache.axis2.databinding.ADBException: Unexpected subelement {<a href="http://model.api.apimgt.carbon.wso2.org/xsd" rel="nofollow noreferrer">http://model.api.apimgt.carbon.wso2.org/xsd</a>}id
          at org.wso2.carbon.apimgt.api.model.xsd.URITemplate$Factory.parse(URITemplate.java:3025)
          at org.wso2.carbon.apimgt.keymgt.stub.types.axis2.GetAllURITemplatesResponse$Factory.parse(GetAllURITemplatesResponse.java:489)
          at org.wso2.carbon.apimgt.keymgt.stub.validator.APIKeyValidationServiceStub.fromOM(APIKeyValidationServiceStub.java:1376)
          ... 23 more
  Caused by: org.apache.axis2.databinding.ADBException: Unexpected subelement {<a href="http://model.api.apimgt.carbon.wso2.org/xsd" rel="nofollow noreferrer">http://model.api.apimgt.carbon.wso2.org/xsd</a>}id
          at org.wso2.carbon.apimgt.api.model.xsd.URITemplate$Factory.parse(URITemplate.java:3019)
          ... 25 more</p>
  
  <p>I have imported self signed certificate of WSO2 IS-KM in API Manager.
  I am using a Postgre DB and have created separate DB for AM(WSO2AMDB), UM(WSO2UMDB) and REG(WSO2CarbonDB). Both WSO2API-M and WSO2IS-KM are sharing these DBs.</p>
  
  <p>Please help me out resolving this issue.</p>
  
  <p>N.B - When I used only WSO2API manager with it's own Key manager, I could successfully test an API call from PostMan to back end REST service through API gateway.</p>