Possible causes of "invalid assertion" error in SAML assertion oauth flow

Question

I'm trying to get an oauth access token using the SAML Assertion oauth flow and getting back the generic invalid assertion error message.

{
    "error": "invalid_grant", 
    "error_description": "invalid assertion"
}

I know there are a number of issues that could cause this error but feel like I've tried just about everything and not sure what I am missing.

1. Signed SAML assertion has been validated with the SF SAML assertion validator.
2. I am using the following to base64URL encode the assertion http://www.simplycalc.com/base64url-encode.php.
3. The endpoint matches oauth 2.0 token endpoint in the SSO config.
4. The recipient in the assertion was changed to the oauth endpoint. e.g

https://MYDOMAIN.cs67.my.salesforce.com/services/oauth2/token?so=00D0n0000000QUx

curl command

curl -X POST https://MYDOMAIN.cs67.my.salesforce.com/services/oauth2/token -d "so=00D0n0000000QUx" -d "grant_type=assertion" -d "assertion_type=urn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Aprofiles%3ASSO%3Abrowser" -d "assertion=PD94bW..."

Answer 1

Update 2: It looks like you might be using the wrong encoding for the SAML Assertion Flow (doc link: https://help.salesforce.com/articleView?id=remoteaccess_oauth_web_sso_flow.htm&type=0)

You need to base64 encode first and then take the results and URLEncode that string. base64url encoding isn't the same as a base64 encoding which is subsequently URL encoded.

---

Update: Sorry, I see that you noted you used this page to validate your assertion, but did it validate the signature and then show an error when trying to match to a username or federation id?

---

One troubleshooting tool which often gets overlooked is the SAML Assertion Validator page in your org.

The page will show you the details of the last failed assertion in addition to giving you a place where you could copy/paste the XML of a SAML response. This page should give you more insight than the generic response that you receive on the outside.

https://developer.salesforce.com/docs/atlas.en-us.identityImplGuide.meta/identityImplGuide/identity_quickstart_troubleshoot.htm

Example detail of a failed assertion (login failure)

Answer 2

It looks like there's a salesforce help article with 2 possible causes of this issue. Might be worth checking out:

OAuth 2.0 SAML Bearer assertion flow receives {"error_description":"invalid assertion","error":"invalid_grant"}