Failed to parse key: policy(Generate-JWT-RS256)

[Srinivas-telstr]

Hello Mate,

I am trying to generate jwt with no success...below are the details.

{

    "fault": {

        "faultstring": "Failed to parse key: policy(Generate-JWT-RS256)",

        "detail": {

            "errorcode": "steps.jwt.KeyParsingFailed"

        }

    }

}

policy:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<GenerateJWT name="Generate-JWT-RS256" enabled="true" continueOnError="false">
<Algorithm>RS256</Algorithm>
<PrivateKey>
<Value ref="private.privatekey"/>
<Id>private_key</Id>
</PrivateKey>
<Id/>
<!-- this tells Apigee to generate a unique identifier -->
<Subject>Salesforce JWT for Oauth Token</Subject>
<!-- you can use ref= for the issuer as well -->
<Issuer ref="JWT_Issuer"/>
<Audience ref="JWT_Audience"/>
<ExpiresIn ref="JWT_ExpiresIn"/>
<AdditionalClaims>
<Claim name="prn" ref="JWT_prn"/>
</AdditionalClaims>
<OutputVariable>output-jwt</OutputVariable>
<DisplayName>Generate-JWT-RS256</DisplayName>
</GenerateJWT>

could you please suggest what is wrong..

[dchiesa1]

This message tells you that the GenerateJWT policy is unable to parse the private key.

According to the configuration you showed,

   ...
  <PrivateKey>
    <Value ref="private.privatekey"/>
    <Id>private_key</Id>
  </PrivateKey>
   ...

...the private key is contained in a context variable called private.privatekey . All of that looks fine.

Because the algorithm you specified is RS256,  you need an RSA private key in that variable.  The contents of that variable should be something like this:

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEA1Z3zcNWDxCzipx8HNxYy/59o2/yQP8WtDjjAbYcpZ2vVRG1w
3N5mXGsAHms4GaQ+HbxPEaD/gj7BZquGF98IEeRPpfqLYWVRiEx6vHsiPFotl1FB
...
h4ReeUDE82slMJIWZ3PNmsT0QMlXY7etUzr6mkCntox7AsVaGpj6r6oraq0+rPOQ
WcoFScnqk7Z+uNuCAqw0CY8dL/fnIil+dF8n+Zc0XCALNS1r8JHB
-----END RSA PRIVATE KEY-----

OR

-----BEGIN PRIVATE KEY-----
MIIEowIBAAKCAQEA1Z3zcNWDxCzipx8HNxYy/59o2/yQP8WtDjjAbYcpZ2vVRG1w
3N5mXGsAHms4GaQ+HbxPEaD/gj7BZquGF98IEeRPpfqLYWVRiEx6vHsiPFotl1FB
...
h4ReeUDE82slMJIWZ3PNmsT0QMlXY7etUzr6mkCntox7AsVaGpj6r6oraq0+rPOQ
WcoFScnqk7Z+uNuCAqw0CY8dL/fnIil+dF8n+Zc0XCALNS1r8JHB
-----END PRIVATE KEY-----

If there is something other than of THAT FORM in the context variable, or if the context variable is empty or unset, then the policy will issue the "Failed to parse key" error that you observed.

[Srinivas-telstr]

Hello Sir..

How to get the key in above format? When i trace the log below is the log

i am using parameter called JWT_privatekey, but that is not showing in trace

-<VariableAccess>

<Get name="JWT_prn" value="*****"/>

<Get name="JWT_Issuer" value="3MVG9e2mBbZnmM6nDZMyDgh_kdmBzDep0i2nTSe4HInnM9LmTWd4W5EmBqydC0afzToeSiwrs8YfSoK7xkEwW"/>

<Get name="JWT_Audience" value="urn://c60511c0-12a2-473c-80fd-42528eb65a6a"/>

<Get name="JWT_ExpiresIn" value="60m"/>

<Set name="jwt.Generate-JWT-RS256.error" value="cannot instantiate private key" success="true"/>

<Set name="JWT.failed" value="true" success="true"/>

<Get name="JWT.Generate-JWT-RS256"/>

<Set name="error.status.code" value="500" success="true"/>

<Set name="apigee.metrics.policy.Generate-JWT-RS256.timeTaken" value="350646" success="true"/>

</VariableAccess>

[dchiesa1]

I am using parameter called JWT_privatekey, but that is not showing in trace

Are you sure? Your prior policy configuration showed this:

  ...
 <PrivateKey>
  <Value ref="private.privatekey"/>
  <Id>private_key</Id>
 </PrivateKey>
  ...

The private. prefix is required here. And Apigee automatically masks accesses (reads or writes) to variables that have the private. prefix, so you will never see it in the trace session.

If you want to see a private variable in trace, you need to add a new policy, like AssignMessage, and assign from one variable to another. like this:

<AssignMessage name='AM-Diagnostics'>
  <AssignVariable>
    <Name>doesnot-matter</Name>
    <Ref>private.privatekey</Ref>
  </AssignVariable>
</AssignMessage>

If you attach this into your proxy flow, the variable doesnot-matter will appear in Trace, and it will have the value of the private.privatekey variable.

[dchiesa1 · Accepted solution]

How to get the key in above format?

There are many options. one of them is probably right for you depending on where you are starting from.

[Srinivas-telstr]

Hello dchiesa1,

I am integrating two Salesforce instances using apigee edge, As a part of that i have created an API for target instance and tested by using postman. It is working fine with 201 response code with created record id.

But when i am testing the same via salesforce(source), i am getting 200 response and record is not getting created in target. What should i do now? I need record gets created..

[dchiesa1]

Hi Srinivas

It looks like you have a new question. Kindly as a new question by clicking the blue box in the upper right corner. We can address it there.