4

I am trying to get JWT Bearer Token Flow to work. But get the error user hasn't approved this consumer. I have read these posts:

Salesforce JWT User Hasn't Approved This Consumer (Again)

OAuth 2.0 JWT Bearer Token Flow

OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error

and all seem to say the same, that the application needs to be authorized. I am doing this, but still get the error. Is there something else that I am missing?

Authorize

POST https://login.salesforce.com/services/oauth2/authorize HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
Content-Length: 151
Expect: 100-continue
Connection: Keep-Alive

response_type=code&client_id=3MV...4QJ3&redirect_uri=https%3A%2F%2Flocalhost

JWT Request

POST https://login.salesforce.com/services/oauth2/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: login.salesforce.com
Content-Length: 666
Expect: 100-continue

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=eyJhbGciOiJ...pjCY1Ug

JWT Response

HTTP/1.1 400 Bad Request
Date: Sat, 10 Feb 2018 13:40:45 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: upgrade-insecure-requests 
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Set-Cookie: BrowserId=A1Sl9NmzQ5eoVt_etmmBbg;Path=/;Domain=.salesforce.com;Expires=Wed, 11-Apr-2018 13:40:45 GMT;Max-Age=5184000
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 82

{"error":"invalid_grant","error_description":"user hasn't approved this consumer"}
  • 4
    What are the scopes you've selected for your connected app? (api + refresh_token/offline_access seem to both be required.) Are you using the same user for the JWT as you are for authroizing? Do you need users to self-authorize (having an admin mark certain profiles as pre-authorized makes the JWT flow a bit easier at the cost of a little security). – Derek F Feb 10 '18 at 14:39
  • 1
    Also, you can check to see if your authorization attempt actually went through by checking a few places. If authorization did succeed, you should see a session for your specified user in the "User Session Information" page (setup menu -> search for "session management"). You should also see your connected app in the "OAuth connected apps" related list of your user's detail page. – Derek F Feb 10 '18 at 14:45
  • 3
    Changing from All users must self-authorize to Admin approved users are pre-authorized did the trick. Thanks for that! I guess this is the option I should go with since the integration is from another system. But let's say I wanted to go with All users must self-authorize. What would I have to do? – user3274635 Feb 10 '18 at 15:21
  • 2
    I'm not entirely sure, since I've only ever used the pre-authorized setting myself. That's why I was asking questions and pointing you to places where you could check to see if the user-driver authorization had actually worked. The other questions you linked suggest that you need to first use a flow that generates a refresh token (user-agent, or web server flows). – Derek F Feb 10 '18 at 15:41
0

Just a brief addition, as I'm sure the OP has resolved this issue long ago by now. It may be helpful for others in the future.

I had the same issue, while was working in a sandbox

  • created my Connected App
  • built the JWT token via Python 3, PyJWT
  • sent the requests via Python 3, requests

Each piece seemed to be perfectly fine but got back the {'error': 'invalid_grant', 'error_description': "user hasn't approved this consumer"} error every time regardless any (pointless) effort.

For me, the OAuth 2.0 JWT Bearer Token Flow giving a user hasn't approved this consumer error solution worked perfectly fine.

It seems the OP tried to send the authentication via Curl or HTTP client but in fact, it should be opened in a browser.

https://login.salesforce.com/services/oauth2/authorize?client_id=[clientId]&redirect_uri=[redirectUri]&response_type=code

where the [clientId] is the connected app Consumer Key and the [redirectUri] is the Callback URL. Of course, the domain should be correct for the type of environment the app is running (test.salesforce.com for sandbox, etc.)

When the URL is opened in a browser Salesforce.com - after login - will open up a page similar to this to review and accept the scopes of the requested app.

SF connected app auth

This wouldn't work with a command-line app (curl, http, etc)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.