I'm trying to get an oauth access token using the SAML Assertion oauth flow and getting back the generic invalid assertion error message.

    "error": "invalid_grant", 
    "error_description": "invalid assertion"

I know there are a number of issues that could cause this error but feel like I've tried just about everything and not sure what I am missing.

  1. Signed SAML assertion has been validated with the SF SAML assertion validator.
  2. I am using the following to base64URL encode the assertion http://www.simplycalc.com/base64url-encode.php.
  3. The endpoint matches oauth 2.0 token endpoint in the SSO config.
  4. The recipient in the assertion was changed to the oauth endpoint. e.g


curl command

curl -X POST https://MYDOMAIN.cs67.my.salesforce.com/services/oauth2/token -d "so=00D0n0000000QUx" -d "grant_type=assertion" -d "assertion_type=urn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aprofiles%3ASSO%3Abrowser" -d "assertion=PD94bW..."

2 Answers 2


Update 2: It looks like you might be using the wrong encoding for the SAML Assertion Flow (doc link: https://help.salesforce.com/articleView?id=remoteaccess_oauth_web_sso_flow.htm&type=0)

You need to base64 encode first and then take the results and URLEncode that string. base64url encoding isn't the same as a base64 encoding which is subsequently URL encoded.

Update: Sorry, I see that you noted you used this page to validate your assertion, but did it validate the signature and then show an error when trying to match to a username or federation id?

One troubleshooting tool which often gets overlooked is the SAML Assertion Validator page in your org.

The page will show you the details of the last failed assertion in addition to giving you a place where you could copy/paste the XML of a SAML response. This page should give you more insight than the generic response that you receive on the outside.


Example detail of a failed assertion (login failure)

enter image description here

  • Yes, I used the SAML assertion validator to confirm the XML. validation results: ibb.co/mj3iLw. The weird thing is I'm not seeing the attempt in login history or my failed assertion in the validator. I can do oauth uname/pw flow fine so the endpoint is working but it doesn't like something about how I'm sending the assertion. Nov 8, 2017 at 19:50
  • and after it validated the XML, what did it show in the message section below the 14 attributes it verifies? (asking because the screenshot doesn't show it)
    – Mark Pond
    Nov 9, 2017 at 1:55
  • Subject: testfedid AssertionId: pfxbb461208-45d0-4aa0-b4a9-2c9c496bb642 Nov 9, 2017 at 2:31
  • @GregGrinberg did you see the 'update 2' text I added to this answer? Did you get a chance to test that out?
    – Mark Pond
    Nov 9, 2017 at 20:35
  • 1
    Yes, same result. I was actually trying basically every permutation of base64, deflating, and url encoding it which is why I had that. I've narrowed it down to something in the assertion XML or SAML response envelope itself that SF doesn't like but that passes the SAML assertion validator. I built a SAML assertion and oauth request manually in apex and sign it with the IdPs private key and was able to have that go through successfully. At this point I just have an open case with SF to figure our what the offending XML is. Nov 10, 2017 at 4:03

It looks like there's a salesforce help article with 2 possible causes of this issue. Might be worth checking out:

OAuth 2.0 SAML Bearer assertion flow receives {"error_description":"invalid assertion","error":"invalid_grant"}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .