0

What i've already done:

  1. Created Connected App
  2. Generated self-signed certificate
  3. Provided cert to app
  4. Changed Policy to 'Admin approved users'
  5. Provided Profile to app, created user with this profile
  6. Retrieved Private Key from cert
  7. Generated JWT ...
  8. Non profit- status 400

What i did wrong? Interesting thing - Mulesoft salesforce connector works fine with the same data

Improve this question
2
  • Are you sure that's the error message you're getting? Have you double-checked that your client id (consumer id) is correct (no trailing space)? How are you generating/sending the JWT (from Apex, Javascript, cURL, postman, something else)? Have you gone through the "web server" flow for your connected app before trying to go through the JWT flow (that only needs to be done once per org)?
    – Derek F
    Commented Mar 14 at 13:12
  • 1
    I'm using postman. sure i've already passed web server way (call to /services/oauth2/authorize - passed successfully) message: { "error": "invalid_client_id", "error_description": "client identifier invalid" }
    – pincet
    Commented Mar 14 at 13:18

1 Answer 1

Reset to default
0

This is a Postman issue.
At time of writing, Postman isn't really a good choice for going through Salesforce's "JWT Bearer Flow" OAuth 2.0 flow.

  • The "OAuth 2.0" Type helper (under the "Authorization" tab) doesn't have the appropriate Grant Type
  • The "JWT Bearer" Type helper (under the "Authorization" tab) doesn't give us the option to add the JWT to the request body

Using the "JWT Bearer" Type helper can take care of most of the steps, but you would need to:

  1. add the grant_type, urn:ietf:params:oauth:grant-type:jwt-bearer key/value pair as a body variable (x-www-form-urlencoded)
  2. go to the "code snippet" sidebar (</> in the right-hand sidebar), and copy the JWT (either from the Authorization header - everything after "Bearer ", or the "token" query parameter), then paste it into another body variable (the key would be "assertion")

An alternative to that second step would be to use a pre-request script in Postman to manually generate the JWT, and add it to the request body in a Pre-request script.

...at least it would be if we could encrypt using RSA (RS256 = RSA encryption followed by sending the ciphertext through SHA256). Postman only provides the aging (and no longer being developed) crypto-js package, which does not have anything for using asymmetric encryption algorithms.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .