6

I am getting an invalid assertion 400 json response from salesforce when i try get an oauth access token using the saml bearer oauth grant flow. {"error_description":"invalid assertion","error":"invalid_grant"}

I am following setup instructions from here: https://login.salesforce.com/help/doc/en/remoteaccess_oauth_SAML_bearer_flow.htm

Now is there anyway of getting more debug information about what is wrong with the assertion ? I have setup the assertion as per the spec and the document above. The message content type is set to application/x-www-form-urlencoded. I am also url encoding the grant type and the assertion. If i look at my generated assertion in an online base 64 url decoder, i see that i have to url decode the assertion and then base64 decode to see the contents of assertion. This looks fine. How can i go about finding out what salesforce does not like with the assertion.

Secondly I am not sure of the setup required in salesforce to ensure my connected app is configured correctly to handle the saml bearer flow. Currently i have created a remote access connected app, this app has oauth enabled and i have a consumer key, secret, redirect url(which isnt need in saml bearer flow) and also a digital certificate so that salesforce can decrypt the assertion i send which in encrypted with a private key. I also have a scope of full access enabled.

I really could do with some help showing me exactly what i need to do to get this working or at the very least some sort of way of determining what i am doing wrong. The json message is probably a bit thin in that it would be nice if the particular problem with the assertion was sent back.

Any help with this is much appreciated. Clive

Improve this question

1 Answer 1

Reset to default
4

I think I've had that problem in the past, and it was down to how the assertion was being encoded.

I used this online Base64URL encoder to try and match up how the assertion looked after it was Base64URL Encoded. http://kjur.github.io/jsjws/tool_b64uenc.html

I would also look at the login history of the User you're trying to login as on Salesforce as that could give you a clue as to what's going wrong.

Improve this answer
6
  • Ok you were correct about the encoding. I am now getting closer to a resolution to my problem. I currently get the following response: {"error_description":"user hasn't approved this consumer","error":"invalid_grant"} . So for the user in question i need to approve access to the app. Not sure where this is done
    – user4077
    Commented Oct 10, 2013 at 16:17
  • @user4077 Could you ask this as a new question? I have an answer, but it won't really fit well as a comment.
    – metadaddy
    Commented Oct 10, 2013 at 17:35
  • 1
    On the Connected App either set All Users can authorize or if you want to pre approve certain users, set Admin Approved Users are Pre Authorised and either add the Profiles to the Connected App or add individual users to an empty permission set and associate it with the connected app.
    – techtrekker
    Commented Oct 10, 2013 at 18:56
  • 1
    Yeah, @techtrekker - that's what I was going to say, but I wanted user4077 to ask a new question, so the answer was more visible :-)
    – metadaddy
    Commented Oct 11, 2013 at 1:32
  • I'd agree @metadaddy, Didn't see a new question so posted here. Can append to my original answer if it helps.
    – techtrekker
    Commented Oct 11, 2013 at 2:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .