OAuth2.0 JWT bearer token flow with alg HS256 issue

Question

I have written the below python code for JWT integration:

from datetime import datetime
import jwt
import time
import requests

# *** Update these values to match your configuration ***
IS_SANDBOX = True
KEY_FILE = 'server11.key'
ISSUER = 'XYZ'
SUBJECT = '[email protected]'
# *******************************************************

DOMAIN = 'test' if IS_SANDBOX else 'login'

print('Loading private key...')
with open(KEY_FILE) as fd:
    private_key = fd.read()

print('Generating signed JWT assertion...')
claim = {
    'iss': ISSUER,
    'exp': int(time.time()) + 300,
    'aud': 'https://{}.salesforce.com'.format(DOMAIN),
    'sub': SUBJECT,
}
assertion = jwt.encode(claim, private_key, algorithm='HS256', headers={'alg':'hmacSHA256'})


print('Making OAuth request...')
r = requests.post('https://{}.salesforce.com/services/oauth2/token'.format(DOMAIN), data = {
    'grant_type':'urn:ietf:params:oauth:grant-type:jwt-bearer',
    'assertion': assertion,
})

print('Status:', r.status_code)
print(r.json())

The error I'm getting is like this I don't know why

Status: 400
{'error': 'invalid_grant', 'error_description': 'invalid assertion'}

Process finished with exit code 0

Answer 1

From the help page on the JWT flow:

Salesforce requires that a JWT is signed using RSA SHA256, which uses an uploaded certificate as the signing secret.

HS256 is not accepted by Salesforce (via a connected app and the Salesforce-provided services/oauth2/token service).