将jwt交换为访问令牌会返回invalid_grant错误

Question

我正在尝试为我的应用程序实现服务集成身份验证-管理员同意。我是这样创建jwt的:

class Program
{
    static void Main(string[] args)
    {
        #region Test

        string integratorKey = "integratorKey ";
        string userId = "userId ";
        string serverAddress = "serverAddress";
        string scope = "signature";
        string key = @"C:\Users\Tester\Desktop\privatekey.txt";

        // JWT Header
        // The header specfies the token type and the signature algorithm
        var jwtHeader = new JwtHeader
        {
            { "typ ", "JWT "},
            { "alg", "RS256"},
        };

        // JWT Body
        // The body specfies the account and user id granting consen
        var jwtPayload = new JwtPayload
        {
           { "iss ", integratorKey},
           { "sub", userId},
           { "iat", DateTimeOffset.UtcNow.ToUnixTimeSeconds()},
           { "exp", DateTimeOffset.UtcNow.AddHours(1).ToUnixTimeSeconds()},
           { "aud", serverAddress},
           { "scope", scope}
        };

        // JWT Signature
        // The body contains the result of signing the base64url-encoded header and body
        string pemKey = File.ReadAllText(key);
        var rsa = CreateRSAKeyFromPem(pemKey);
        RsaSecurityKey rsaKey = new RsaSecurityKey(rsa);

        var jwtSecurityToken = new JwtSecurityToken(jwtHeader, jwtPayload);
        jwtSecurityToken.SigningKey = rsaKey;

        // Token to String so you can use it in your client
        var jwtHandler = new JwtSecurityTokenHandler();
        var tokenString = jwtHandler.WriteToken(jwtSecurityToken);
        #endregion
    }

    public static RSA CreateRSAKeyFromPem(string key)
    {
        TextReader reader = new StringReader(key);
        PemReader pemReader = new PemReader(reader);

        object result = pemReader.ReadObject();

        if (result is AsymmetricCipherKeyPair)
        {
            AsymmetricCipherKeyPair keyPair = (AsymmetricCipherKeyPair)result;
            return DotNetUtilities.ToRSA((RsaPrivateCrtKeyParameters)keyPair.Private);
        }
        else if (result is RsaKeyParameters)
        {
            RsaKeyParameters keyParameters = (RsaKeyParameters)result;
            return DotNetUtilities.ToRSA(keyParameters);
        }

        throw new Exception("Unepxected PEM type");
    }
}

我已经在 jwt.io 上验证了此代码生成的令牌，一切看起来都不错。但是，当我尝试使用Postman将生成的jwt交换为访问代码时，我总是会得到“invalid_grant”，这是我在postman中发出请求的方式：

POST https://account-d.docusign.com/oauth/token
-Headers: Content-Type application/x-www-form-urlencoded

-Body: grant_type urn:ietf:params:oauth:grant-type:jwt-bearer assertion [Generated jwt]

我什至尝试过把

Headers: Authorization Basic b64encoded(integratorKey:secretKey) 

以及，但仍然没有运气。

你能指出我在这里做错了什么吗？谢谢：）

Answer 1

好的，我自己已经弄清楚了问题所在，现在我可以在邮差中接收访问令牌。我改变了三件事，使这项工作得以实现：

>

当我从组织门户授权应用程序时，我已将应用程序分配给不正确的集成商密钥，因此我需要将其更改为指向正确的密钥。

我在C# SDK中找到了生成jwt的代码，所以我用它来确保创建的jwt被DocuSign接受:

static void Main(string[] args)
{
    string integratorKey = "integratorKey ";
    string userId = "userId ";
    string serverAddress = "account-d.docusign.com";
    string scope = "signature impersonation";
    string privateKeyFilename = @"C:\Users\Tester\Desktop\privatekey.txt";

    JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();

    SecurityTokenDescriptor descriptor = new SecurityTokenDescriptor()
    {
        IssuedAt = DateTime.UtcNow,
        Expires = DateTime.UtcNow.AddHours(1)
    };

    descriptor.Subject = new ClaimsIdentity();
    descriptor.Subject.AddClaim(new Claim("scope", scope));
    descriptor.Subject.AddClaim(new Claim("aud", serverAddress));
    descriptor.Subject.AddClaim(new Claim("iss", integratorKey));

    if (userId != null)
    {
        descriptor.Subject.AddClaim(new Claim("sub", userId));
    }

    if (privateKeyFilename != null)
    {
        string pemKey = File.ReadAllText(privateKeyFilename);
        var rsa = CreateRSAKeyFromPem(pemKey);
        RsaSecurityKey rsaKey = new RsaSecurityKey(rsa);
        descriptor.SigningCredentials = new SigningCredentials(rsaKey, SecurityAlgorithms.RsaSha256Signature, SecurityAlgorithms.HmacSha256Signature);
    }

    var token = handler.CreateToken(descriptor);
    string jwtToken = handler.WriteToken(token);
}

public static RSA CreateRSAKeyFromPem(string key)
{
    TextReader reader = new StringReader(key);
    PemReader pemReader = new PemReader(reader);

    object result = pemReader.ReadObject();

    if (result is AsymmetricCipherKeyPair)
    {
        AsymmetricCipherKeyPair keyPair = (AsymmetricCipherKeyPair)result;
        return DotNetUtilities.ToRSA((RsaPrivateCrtKeyParameters)keyPair.Private);
    }
    else if (result is RsaKeyParameters)
    {
        RsaKeyParameters keyParameters = (RsaKeyParameters)result;
        return DotNetUtilities.ToRSA(keyParameters);
    }

    throw new Exception("Unepxected PEM type");
}

在我做了更改1和2之后，我仍然在Postman中有一个错误:“需要同意”。结果是我必须向我的集成器键添加一个重定向uri，然后导航到这个url:

SERVER/oauth/auth?response_type=code&scope=signature%20impersonation&client_id=CLIENT_ID&redirect_uri=https://docusign.com

然后单击“授予”。

希望这有所帮助。