JWT Bearer Token returns Invalid Assertion | Community
Skip to main content
S
sriram_1
June 8, 2022
Solved

JWT Bearer Token returns Invalid Assertion

  • June 8, 2022
  • 3 replies
  • 2077 views

I am trying to connect  to aem using a JWT Bearer Token.
I have followed all the tutorials and cannot seem to find what is wrong.

The error message is: error: invalid_grant, error_description: invalid assertion

 

what could be the reason?

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by milind_bachani

Hi @sriram_1 ,


Check this link : https://medium.com/tech-learnings/how-to-manage-the-protected-aem-resources-through-oauth-2-0-851ce4c7a5ef


I would also suggest you to use : https://jwt.io/ for validation.

The structure of the JWT assertion looks like this

Base64URL({header}).Base64URL({claims}).Base64URL(RSA(SHA256(Base64URL({header}).Base64URL({claims}))))

or grouped a bit differently for readability

encodedHeader = Base64URL({header})
encodedClaims = Base64URL({claims})
token = encodedHeader.encodedClaims

assertion = token.Base64URL(RSA(SHA256(token)))

The private key is used in generating the signature (i.e. the second part of the "assertion"). If your assertion doesn't start with eyJhbGciOiJSUzI1NiJ9 (the Base64 encoded version of {"alg":"RS256"}) then it is wrong.


Thanks,

Milind

3 replies

milind_bachani
Adobe Employee
milind_bachaniAdobe EmployeeAccepted solution
Adobe Employee
June 8, 2022

Hi @sriram_1 ,


Check this link : https://medium.com/tech-learnings/how-to-manage-the-protected-aem-resources-through-oauth-2-0-851ce4c7a5ef


I would also suggest you to use : https://jwt.io/ for validation.

The structure of the JWT assertion looks like this

Base64URL({header}).Base64URL({claims}).Base64URL(RSA(SHA256(Base64URL({header}).Base64URL({claims}))))

or grouped a bit differently for readability

encodedHeader = Base64URL({header})
encodedClaims = Base64URL({claims})
token = encodedHeader.encodedClaims

assertion = token.Base64URL(RSA(SHA256(token)))

The private key is used in generating the signature (i.e. the second part of the "assertion"). If your assertion doesn't start with eyJhbGciOiJSUzI1NiJ9 (the Base64 encoded version of {"alg":"RS256"}) then it is wrong.


Thanks,

Milind

    Kiran_Vedantam
    Community Advisor
    Kiran_VedantamCommunity Advisor
    Community Advisor
    June 8, 2022

    Hi @sriram_1 

     

    The error itself says there is some issue with the grant type. What grant type are you using? It should be something similar to this: 

    "grant_type":"abc"

    Hope this helps.

     

    Thanks,

    Kiran Vedantam.

      Uppari_Ramesh
      Uppari_Ramesh
      March 18, 2024

      Hi @sriram_1 @kiran_vedantam @milind_bachani @kautuk_sahni 

       

      This issue occurs when you have not created JWT token properly. Keep the aud value as your domain as https://test.com/oauth/token and keep iss as client ID. 

       

      Here aud means audience for whom this JWT belongs to and it's present inside JWT payload section.

      Terms & ConditionsAccessibility statement

      Loading footer...