43
votes
Accepted
Authentication using JWT
In the JWT Bearer OAuth flow, the connected app is identified by the connected app's consumer key (provided in the "iss" parameter of the JWT claims). Pre-authorizing users has very little ...
- 64.1k
21
votes
Accepted
Named Credentials - What is the difference between JWT & JWT Token Exchange
JWT Token: SF will issue the token for you. When your code uses the named credential to call your 3rd party service, SF will send the newly issued JWT token to your 3rd party service as a bearer token ...
- 7,816
20
votes
Salesforce JWT User Hasn't Approved This Consumer (Again)
From the Salesforce OAuth JWT Flow documentation (hidden):
A JWT OAuth 2.0 bearer assertion request looks at all the previous approvals for the user that include a refresh_token. If matching ...
- 601
12
votes
Salesforce JWT User Hasn't Approved This Consumer (Again)
For either the sub or prn value, make sure you are using a
username that exists in that org.
For the aud make sure you are using test.salesforce.com for a sandbox environment and login.salesforce.com ...
- 415
9
votes
SalesforceDX: Log in to sandbox by username/password from command line without browser involved
sfdx force:auth only provides the JWT and web OAuth login methods:
sfdx force:auth commands: (get help with sfdx help force:auth:COMMAND)
force:auth:jwt:grant authorize an org using the JWT ...
- 93.6k
9
votes
Accepted
JWT Bearer Token flow for Community: Invalid Token
I ended up finding what was causing the error. In the doc that I mentioned in my question they were suggesting the use of https://community.force.com/customers as the token endpoint.
But in Configure ...
- 183
9
votes
Accepted
Error authenticating with JWT config due to: audience is invalid
I'm not set up to test the scenario you've laid out precisely, but I was able to repoduce the error using what I imagine is equivalent code in the developer console. Looks like the -r/--instanceurl ...
- 64.1k
7
votes
Accepted
How do I install and preauthorize app so I can use the JWT Bearer token flow?
There are much more detailed instructions on setting up JWT authentication in the Salesforce DX Developer Guide, because JWT is often used for CI and other headless authentication use cases. While the ...
- 93.6k
7
votes
This org appears to have a problem with its OAuth configuration. Reason: invalid_grant - audience is invalid
Run the following command first
export SFDX_AUDIENCE_URL=https://test.salesforce.com
Then run
sfdx force:auth:jwt:grant --clientid <myclientid> --jwtkeyfile server.key --instanceurl https://...
- 173
7
votes
Accepted
Salesforce OAuth 2.0 JWT Bearer Token Flow - Token Expiration
The length of time that your access token is valid is determined by the session timeout value in the Connected App's policies. By default, I believe that this timeout is not set, in which case the ...
- 64.1k
6
votes
Setting Up JWT oAuth Flow
just as an FYI: you could have avoided the manual login if you had set the policy settings to:
Permitted Users: Admin approved users are pre-authorized
and then assigned the Connected App to the ...
- 71
6
votes
Accepted
Using the Crypto.verify() method to verify a JWT signature
JWT is encoded using base64 url-safe scheme so you must decode the signature appropriately when you convert it into bytes, straight base64 decoding won't do.
URL-safe base64 encoding is defined in JWS ...
- 7,816
6
votes
Accepted
How to know what certificate is associated with a connected app?
You can see the certificate's subject in the admin UI on the connected app details page (Setup > Build > Apps > Create ... find your app and click on the app name). The Digital Certificate ...
- 7,816
5
votes
Salesforce JWT User Hasn't Approved This Consumer (Again)
My issue was I was using https://test.salesforce.com/ for the Authentication.
Since our org has mydomain enabled so I have give my org url https://****--trng.sandbox.my.salesforce.com/ in the below ...
- 151
5
votes
JWT bearer token flow in web app
If you plan to implement an integration that requires the user to login regulary, then you can just use OAuth2 flow and invoke it whenever the user interacts with your app. However, if you intend to ...
- 51
5
votes
Accepted
JWT bearer token flow in web app
tl;dr:
Using the JWT Bearer flow is highly unlikely to save you any trouble. Just bite the bullet and implement controls to use the refresh token flow.
full version:
The more I think about this, the ...
- 64.1k
5
votes
Salesforce JWT User Hasn't Approved This Consumer (Again)
"user hasn't approved this consumer" This is a common error caused when the user doesn't have a prior refresh_token associated with him/her.
The solution is to perform an Autorization grant (Web ...
- 675
5
votes
Can I connect to a sandbox using JWT Flow and Prod connect app?
You can use the Connected App from your production org, but to avoid the user hasn't approved this consumer error, I've found that you need to authenticate using the password and the Connected App's ...
- 2,498
5
votes
Accepted
sfdx force:auth:jwt:grant ignoring the instanceurl param
I finally managed to solve this myself, but I still believe there is a small bug in SFDX CLI that steered me off my course when debugging this.
The root cause turned out to be an incorrect system ...
- 815
5
votes
JWT, Cyrpto.Sign and EncodingUtil.base64Encode
As JWT is meant to be url-safe, the 62nd and 63rd characters used in Base64 encoding (+ and /, respectively) which are not url-safe must be replaced with characters that are url safe.
+ is mapped to -,...
- 64.1k
5
votes
Accepted
SalesforceDX: Log in to sandbox by username/password from command line without browser involved
You could use the auth command from the sfpowerkit plugin:
sfpowerkit auth:login
https://github.com/Accenture/sfpowerkit
It supports login with username-password combination (probably will need ...
- 1,149
5
votes
Salesforce connecting to a JWT service via Named Credentials - JWT Token Exchange
Here is the configuration I have to have Salesforce 2 calling Salesforce 1 API:
In Salesforce 2: Named Credentials
Certificate: using one created from Salesforce 2 (Certificates and Key Management)
...
- 990
5
votes
Accepted
Named Credential with JWT Token Exchange for authorizing calls to Google Cloud
GCP also allows JWT as a bearer token (no exchange). On paper, Named Credential supports this option. Unfortunately since this is a proprietary option that is not standardized by a published RFC, the ...
- 7,816
4
votes
Accepted
How to determine the correct 'audience' and 'uri' when using OAuth 2.0 JSON Web Token (JWT) Bearer Token Flow
You only need audience for the oauth 2.0 JWT bearer token flow and for the salesforce sandbox the value is always https://test.salesforce.com .
You don't need uri for this flow .The below document ...
- 91.9k
4
votes
Accepted
Unusual OAuth JWT Bearer Token Flow (Outbound) Integration Pattern
According to the specs you've provided, it makes sense that you cannot use Named Credentials or any of the standard ways of doing this. I assume the responses aren't standard either, so it makes it ...
- 3,467
4
votes
Can I connect to a sandbox using JWT Flow and Prod connect app?
I assume you are trying to JWT into a developer sandbox just refreshed or created from production. If so, I had the same exact problem. I was trying to login with the same --clientid and --jwtkeyfile ...
- 331
4
votes
Accepted
Journey Builder customAcvitity JWT decoded, no organization id
The solution we managed to get the fuel refresh token on the frontend with postmonger (https://salesforce.stackexchange.com/a/185155/61173)
Then we used the response from the API (we used https://www....
- 161
4
votes
JWT authentication without a username?
I really wouldn't call it a hitch. It's good security practices.
In order to authenticate into the org, you need a subject who exists in that org and the URL for the org (My Domain in most cases). ...
- 23.1k
4
votes
Accepted
JWT Token always expires after 'exp' provided in the claims
RFC7523, which defines JWT authentication, specifies in section 3.4 that
The authorization server MUST reject any JWT with an expiration time that has passed, subject to allowable clock skew ...
- 93.6k
4
votes
JWT Bearer flow vs. Username+Password flow in server-to-server integration
I think it is similar to why passwords in db are not stored in straight way, but hashed values are stored. In case, when someone not allowed will get access to it - he will not be able to operate with ...
- 18.8k
Only top scored, non community-wiki answers of a minimum length are eligible