OAuth2 JWT Bearer token flow - "error": "invalid_client", "error_description": "invalid client credentials"

Question

i'm trying to get an access token, in order to make a REST call. I've followed this guide https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_oauth_jwt_flow.htm&language=en_US

Right now, i've set the app's oauth Permitted Users policy to Admin approved users are pre-authorized and the IP Relaxation to Relax IP restrictions

In the profile for the user i am using, i've added the connected app setup/manage users/profiles/myprofile/assigned connected apps

( for the record, initially i've also tried with Permitted Users policy set to All users may self-authorize, and i did the authorization as it is mentioned here https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com

GET to https://login.salesforce.com/services/oauth2/authorize?client_id=<client_id>&redirect_uri=<redirect_url>&response_type=code

login with the salesforce credentials, click on Approve

POST to https://login.salesforce.com/services/oauth2/token 

with

• grant_type:authorization_code
• code: [the value passed to the callback url]
• client_id: [client_id]
• redirect_uri: [the redirect_url sent in the GET and configured in the app settings]
• client_secret:[client_secret]

)

In the OAuth config, i've added all the OAuth Scopes to Selected OAuth Scopes (to make sure this won't cause any errors)

So, with this setup, i make a

POST to https://login.salesforce.com/services/oauth2/token 

with

• grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
• assertion: [the generated JWT assertion]

Now we get to the interesting part: on sandboxes everything works.

on production i get the following response back:

{
    "error": "invalid_client",
    "error_description": "invalid client credentials"
}

I am going mad trying to understand what's wrong here. I've noticed the following error in the login history (setup/manage users/login history)

Login Type:Remote Access 2.0 
Status: Failed: Missing Consumer Key Parameter 
Browser: Jakarta HTTP Common

If I decode the assertion, i get Header:

{
  "alg": "RS256"
}

Payload:

{
  "iss": "[the client id]",
  "sub": "[my username]",
  "aud": "https://login.salesforce.com",
  "exp": 1427455160
}

So, the things that are different from sandboxes (where it works) and production (where it is not working) :

• the url to which the POST is made https://test.salesforce.com -> https://login.salesforce.com (tested also with https://[mydomain].my.salesforce.com)
• the audience (as the url changed)
• the username
• the application's client id (there are different apps on the sandbox and production, so they get different id's and client id's)

any ideeas ? :)

Answer 1

The problem was the certificate uploaded in the Digital Certificate/Digital Signature field of the connected app. After uploading the proper certificate, the access token is returned.