2

I'm trying to get an oauth access token using the SAML Assertion oauth flow and getting back the generic invalid assertion error message.

{
    "error": "invalid_grant", 
    "error_description": "invalid assertion"
}

I know there are a number of issues that could cause this error but feel like I've tried just about everything and not sure what I am missing.

  1. Signed SAML assertion has been validated with the SF SAML assertion validator.
  2. I am using the following to base64URL encode the assertion http://www.simplycalc.com/base64url-encode.php.
  3. The endpoint matches oauth 2.0 token endpoint in the SSO config.
  4. The recipient in the assertion was changed to the oauth endpoint. e.g

https://MYDOMAIN.cs67.my.salesforce.com/services/oauth2/token?so=00D0n0000000QUx

curl command

curl -X POST https://MYDOMAIN.cs67.my.salesforce.com/services/oauth2/token -d "so=00D0n0000000QUx" -d "grant_type=assertion" -d "assertion_type=urn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aprofiles%3ASSO%3Abrowser" -d "assertion=PD94bW..."
2
+100

Update 2: It looks like you might be using the wrong encoding for the SAML Assertion Flow (doc link: https://help.salesforce.com/articleView?id=remoteaccess_oauth_web_sso_flow.htm&type=0)

You need to base64 encode first and then take the results and URLEncode that string. base64url encoding isn't the same as a base64 encoding which is subsequently URL encoded.


Update: Sorry, I see that you noted you used this page to validate your assertion, but did it validate the signature and then show an error when trying to match to a username or federation id?


One troubleshooting tool which often gets overlooked is the SAML Assertion Validator page in your org.

The page will show you the details of the last failed assertion in addition to giving you a place where you could copy/paste the XML of a SAML response. This page should give you more insight than the generic response that you receive on the outside.

https://developer.salesforce.com/docs/atlas.en-us.identityImplGuide.meta/identityImplGuide/identity_quickstart_troubleshoot.htm

Example detail of a failed assertion (login failure)

enter image description here

  • Yes, I used the SAML assertion validator to confirm the XML. validation results: ibb.co/mj3iLw. The weird thing is I'm not seeing the attempt in login history or my failed assertion in the validator. I can do oauth uname/pw flow fine so the endpoint is working but it doesn't like something about how I'm sending the assertion. – Greg Grinberg Nov 8 '17 at 19:50
  • and after it validated the XML, what did it show in the message section below the 14 attributes it verifies? (asking because the screenshot doesn't show it) – Mark Pond Nov 9 '17 at 1:55
  • Subject: testfedid AssertionId: pfxbb461208-45d0-4aa0-b4a9-2c9c496bb642 – Greg Grinberg Nov 9 '17 at 2:31
  • @GregGrinberg did you see the 'update 2' text I added to this answer? Did you get a chance to test that out? – Mark Pond Nov 9 '17 at 20:35
  • 1
    Yes, same result. I was actually trying basically every permutation of base64, deflating, and url encoding it which is why I had that. I've narrowed it down to something in the assertion XML or SAML response envelope itself that SF doesn't like but that passes the SAML assertion validator. I built a SAML assertion and oauth request manually in apex and sign it with the IdPs private key and was able to have that go through successfully. At this point I just have an open case with SF to figure our what the offending XML is. – Greg Grinberg Nov 10 '17 at 4:03
0

It looks like there's a salesforce help article with 2 possible causes of this issue. Might be worth checking out:

OAuth 2.0 SAML Bearer assertion flow receives {"error_description":"invalid assertion","error":"invalid_grant"}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.