用 jwt 交换访问令牌返回 invalid_grant 错误

Question

我正在尝试为我的应用程序实施服务集成身份验证 - 管理员同意。以下是我创建 jwt 的方式：

class Program
{
    static void Main(string[] args)
    {
        #region Test

        string integratorKey = "integratorKey ";
        string userId = "userId ";
        string serverAddress = "serverAddress";
        string scope = "signature";
        string key = @"C:\Users\Tester\Desktop\privatekey.txt";

        // JWT Header
        // The header specfies the token type and the signature algorithm
        var jwtHeader = new JwtHeader
        {
            { "typ ", "JWT "},
            { "alg", "RS256"},
        };

        // JWT Body
        // The body specfies the account and user id granting consen
        var jwtPayload = new JwtPayload
        {
           { "iss ", integratorKey},
           { "sub", userId},
           { "iat", DateTimeOffset.UtcNow.ToUnixTimeSeconds()},
           { "exp", DateTimeOffset.UtcNow.AddHours(1).ToUnixTimeSeconds()},
           { "aud", serverAddress},
           { "scope", scope}
        };

        // JWT Signature
        // The body contains the result of signing the base64url-encoded header and body
        string pemKey = File.ReadAllText(key);
        var rsa = CreateRSAKeyFromPem(pemKey);
        RsaSecurityKey rsaKey = new RsaSecurityKey(rsa);

        var jwtSecurityToken = new JwtSecurityToken(jwtHeader, jwtPayload);
        jwtSecurityToken.SigningKey = rsaKey;

        // Token to String so you can use it in your client
        var jwtHandler = new JwtSecurityTokenHandler();
        var tokenString = jwtHandler.WriteToken(jwtSecurityToken);
        #endregion
    }

    public static RSA CreateRSAKeyFromPem(string key)
    {
        TextReader reader = new StringReader(key);
        PemReader pemReader = new PemReader(reader);

        object result = pemReader.ReadObject();

        if (result is AsymmetricCipherKeyPair)
        {
            AsymmetricCipherKeyPair keyPair = (AsymmetricCipherKeyPair)result;
            return DotNetUtilities.ToRSA((RsaPrivateCrtKeyParameters)keyPair.Private);
        }
        else if (result is RsaKeyParameters)
        {
            RsaKeyParameters keyParameters = (RsaKeyParameters)result;
            return DotNetUtilities.ToRSA(keyParameters);
        }

        throw new Exception("Unepxected PEM type");
    }
}

我已经在 jwt.io 上验证了此代码生成的令牌，一切看起来都不错。但是，当我尝试使用 Postman 将生成的 jwt 交换为访问代码时，我总是会得到“invalid_grant”，这是我在 postman 中提出请求的方式：

POST https://account-d.docusign.com/oauth/token
-Headers: Content-Type application/x-www-form-urlencoded

-Body: grant_type urn:ietf:params:oauth:grant-type:jwt-bearer assertion [Generated jwt]

我什至试过把

Headers: Authorization Basic b64encoded(integratorKey:secretKey) 

也一样，但仍然没有运气。

你能指出我在这里做错了什么吗？谢谢:)

Answer 1

好的，我自己已经弄清楚出了什么问题，现在我可以在 Postman 中接收访问令牌。为了使这项工作，我改变了 3 件事：

1. 当我从组织门户授权应用程序时，我已将应用程序分配给错误的集成商密钥，因此我需要将其更改为指向正确的密钥。

2. 我在 C# SDK 中找到了生成 jwt 的代码，所以我用它来确保创​​建的 jwt 被 DocuSign 接受：

   static void Main(string[] args)
   {
       string integratorKey = "integratorKey ";
       string userId = "userId ";
       string serverAddress = "account-d.docusign.com";
       string scope = "signature impersonation";
       string privateKeyFilename = @"C:\Users\Tester\Desktop\privatekey.txt";
   
       JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
   
       SecurityTokenDescriptor descriptor = new SecurityTokenDescriptor()
       {
           IssuedAt = DateTime.UtcNow,
           Expires = DateTime.UtcNow.AddHours(1)
       };
   
       descriptor.Subject = new ClaimsIdentity();
       descriptor.Subject.AddClaim(new Claim("scope", scope));
       descriptor.Subject.AddClaim(new Claim("aud", serverAddress));
       descriptor.Subject.AddClaim(new Claim("iss", integratorKey));
   
       if (userId != null)
       {
           descriptor.Subject.AddClaim(new Claim("sub", userId));
       }
   
       if (privateKeyFilename != null)
       {
           string pemKey = File.ReadAllText(privateKeyFilename);
           var rsa = CreateRSAKeyFromPem(pemKey);
           RsaSecurityKey rsaKey = new RsaSecurityKey(rsa);
           descriptor.SigningCredentials = new SigningCredentials(rsaKey, SecurityAlgorithms.RsaSha256Signature, SecurityAlgorithms.HmacSha256Signature);
       }
   
       var token = handler.CreateToken(descriptor);
       string jwtToken = handler.WriteToken(token);
   }
   
   public static RSA CreateRSAKeyFromPem(string key)
   {
       TextReader reader = new StringReader(key);
       PemReader pemReader = new PemReader(reader);
   
       object result = pemReader.ReadObject();
   
       if (result is AsymmetricCipherKeyPair)
       {
           AsymmetricCipherKeyPair keyPair = (AsymmetricCipherKeyPair)result;
           return DotNetUtilities.ToRSA((RsaPrivateCrtKeyParameters)keyPair.Private);
       }
       else if (result is RsaKeyParameters)
       {
           RsaKeyParameters keyParameters = (RsaKeyParameters)result;
           return DotNetUtilities.ToRSA(keyParameters);
       }
   
       throw new Exception("Unepxected PEM type");
   }
   

3. 更改 1 和 2 后，我仍然在 Postman 中出现错误：“consent_required”。原来我必须在我的积分器键中添加一个重定向 uri，然后导航到这个 url：

   SERVER/oauth/auth?response_type=code&scope=signature%20impersonation&client_id=CLIENT_ID&redirect_uri=https://docusign.com
   

然后点击“授予”。

希望这会有所帮助。