i'm trying to get an access token, in order to make a REST call. I've followed this guide https://help.salesforce.com/HTViewHelpDoc?id=remoteaccess_oauth_jwt_flow.htm&language=en_US
Right now, i've set the app's oauth Permitted Users policy to Admin approved users are pre-authorized and the IP Relaxation to Relax IP restrictions
In the profile for the user i am using, i've added the connected app setup/manage users/profiles/myprofile/assigned connected apps
( for the record, initially i've also tried with Permitted Users policy set to All users may self-authorize, and i did the authorization as it is mentioned here https://developer.salesforce.com/page/Digging_Deeper_into_OAuth_2.0_on_Force.com
GET to https://login.salesforce.com/services/oauth2/authorize?client_id=<client_id>&redirect_uri=<redirect_url>&response_type=code
login with the salesforce credentials, click on Approve
POST to https://login.salesforce.com/services/oauth2/token
with
- grant_type:authorization_code
- code: [the value passed to the callback url]
- client_id: [client_id]
- redirect_uri: [the redirect_url sent in the GET and configured in the app settings]
- client_secret:[client_secret]
)
In the OAuth config, i've added all the OAuth Scopes to Selected OAuth Scopes (to make sure this won't cause any errors)
So, with this setup, i make a
POST to https://login.salesforce.com/services/oauth2/token
with
- grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
- assertion: [the generated JWT assertion]
Now we get to the interesting part: on sandboxes everything works.
on production i get the following response back:
{
"error": "invalid_client",
"error_description": "invalid client credentials"
}
I am going mad trying to understand what's wrong here. I've noticed the following error in the login history (setup/manage users/login history)
Login Type:Remote Access 2.0
Status: Failed: Missing Consumer Key Parameter
Browser: Jakarta HTTP Common
If I decode the assertion, i get Header:
{
"alg": "RS256"
}
Payload:
{
"iss": "[the client id]",
"sub": "[my username]",
"aud": "https://login.salesforce.com",
"exp": 1427455160
}
So, the things that are different from sandboxes (where it works) and production (where it is not working) :
- the url to which the POST is made https://test.salesforce.com -> https://login.salesforce.com (tested also with https://[mydomain].my.salesforce.com)
- the audience (as the url changed)
- the username
- the application's client id (there are different apps on the sandbox and production, so they get different id's and client id's)
any ideeas ? :)