# OAuth verification for JWT Payload

**URL:** <https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177>\
**Category:** SHF Discussion and Questions\
**Created:** [July 29, 2022, 12:08pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177 "2022-07-29T12:08:53Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisp](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@chrisp](https://developer.sailpoint.com/discuss/u/chrisp)\
**Post date:** [July 29, 2022, 12:08pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/1 "2022-07-29T12:08:53Z")

</div>

We are having 2 major issues with setting up the OAuth verification in SailPoint.

1. Grant\_Type. Our Application requires a grant type of ‘urn:ietf:params:oauth:grant-type:jwt-bearer’ and SailPoinit only supplies a grant\_type of ‘JWT\_BEARER’
2. Epoch values in the JWT payload. The JWT payload that our application requires 2 values that are epoch values based on the current date. The JWT Payload doesn’t allow any values that aren’t hard coded.

Has anyone else had similar issues, and found a solution?

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [July 29, 2022, 1:23pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/2 "2022-07-29T13:23:45Z")

</div>

Hi Chris,

I’m having trouble following what you are trying to accomplish. Our [authentication docs](https://developer.sailpoint.com/idn/api/authentication) make no mention of `JWT_BEARER` being a grant type. Can you please share more details about what you are trying to accomplish with links to any documentation that you have been using?

---

<div class="post-metadata">

**Author:** ![chrisp](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@chrisp](https://developer.sailpoint.com/discuss/u/chrisp)\
**Post date:** [July 29, 2022, 1:41pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/3 "2022-07-29T13:41:36Z")

</div>

Hi Colin,  
Sorry my description was a little sparse and I think I may not have been clear. This isn’t for the SailPoint connection, this is for a source system.  
We’re setting up a Web Service Source. The OAuth 2.0 connection settings that the source requires a grant type of ‘urn:ietf:params:oauth:grant-type:jwt-bearer’. SailPoint has a Grant Type of JWT Bearer token, which gets sent to the source as ‘JWT\_BEARER’(from the log file) The documentation I’m looking at is:  
[https://documentation.sailpoint.com/connectors/webservices/help/integrating\_webservices/connection\_settings.html](https://documentation.sailpoint.com/connectors/webservices/help/integrating_webservices/connection_settings.html)  
and the JWT Bearer Token section specifically.

The second issue is that the source requires 2 values in Epoch format, and they need to be:

1. iat - current epoch value
2. exp - future epoch value, which we’ve tested as iat+6000  
I’m not sure how to get those values dynamically.

Thanks,  
Chris

---

<div class="post-metadata">

**Author:** ![tyler\_mairose](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tyler_mairose/32/30112_2.png) [@tyler\_mairose](https://developer.sailpoint.com/discuss/u/tyler_mairose)\
**Post date:** [July 29, 2022, 2:57pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/7 "2022-07-29T14:57:32Z")

</div>

Hello @chrisp,

Take a look at this rule implemented for custom authentication on a Web Service source. You can use this as a connector rule in the beforeOperationRule on any operation where the custom authentication is needed.

```java
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
 <Rule language="beanshell" name="Custom Authentication" type="WebServiceBeforeOperationRule">
    <Description>
      This rule is used by the Web Services connector before performing any operation like testconnection,
      aggregation etc.
    </Description>
    <Signature returnType="EndPoint">
      <Inputs>
        <Argument name="log">
          <Description>
            The log object associated with the SailPointContext.
          </Description>
        </Argument>
        <Argument name="context">
          <Description>
            A sailpoint.api.SailPointContext object that can be used to query the database if necessary.
          </Description>
        </Argument>
        <Argument name="application">
          <Description>The application whose data file is being processed.</Description>
        </Argument>
        <Argument name="requestEndPoint">
          <Description>The current request information contain header, body, context url, method type, response attribute map,
            successful response code
          </Description>
        </Argument>
        <Argument name="oldResponseMap">
          <Description>earlier response object </Description>
        </Argument>
        <Argument name="restClient">
          <Description>REST Client Object</Description>
        </Argument>
      </Inputs>
      <Returns>
        <Argument name="EndPoint">
          <Description>Updated EndPoint Object</Description>
        </Argument>
      </Returns>
    </Signature>
    <Source><![CDATA[
	  
		import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemReader;
import org.jose4j.jws.JsonWebSignature;
import org.jose4j.jwt.JwtClaims;
import org.jose4j.lang.JoseException;
import org.json.JSONException;
import org.json.JSONObject;
import com.squareup.okhttp.MediaType;
import com.squareup.okhttp.OkHttpClient;
import com.squareup.okhttp.Request;
import com.squareup.okhttp.RequestBody;
import com.squareup.okhttp.Response;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.io.StringReader;
import java.net.HttpURLConnection;
import java.net.URL;
import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.interfaces.RSAPrivateKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Map;

		
		public String generateToken() throws NoSuchAlgorithmException, InvalidKeySpecException, IOException, JoseException {
        java.security.Security.addProvider(new BouncyCastleProvider());
		// Creating instance of PEM reader to get the Secret Key
		PemReader pemReader = new PemReader(new StringReader(SECRET_KEY));
		PemObject pemObject;
		pemObject = pemReader.readPemObject();

		//Getting the RSA instance for KeyFactory
		KeyFactory factory = KeyFactory.getInstance("RSA");
		byte[] content = pemObject.getContent();
		PKCS8EncodedKeySpec privKeySpec = new PKCS8EncodedKeySpec(content);
		RSAPrivateKey privateKey = (RSAPrivateKey) factory.generatePrivate(privKeySpec);

		//Getting the Unix time for UTC
		long unixTime = Instant.now().getEpochSecond();
		//Adding a minute to Unix time UTC

		long unixTime1 = Instant.now().plus(1, ChronoUnit.MINUTES).getEpochSecond();
	
			 JwtClaims claims = new JwtClaims();
			 claims.setClaim("iss","<issuer>");
			 claims.setClaim("aud","<aud_value>");
			 claims.setClaim("scope","<scopes>");
			 claims.setClaim("iat",unixTime);
			 claims.setClaim("exp",unixTime1);
			 
			 JsonWebSignature jws = new JsonWebSignature();
		        jws.setDoKeyValidation(false);
		        jws.setPayload(claims.toJson());
		        jws.setKey(privateKey);
		        jws.setAlgorithmHeaderValue("RS256");

		return jws.getCompactSerialization();
	}

	private String jsonObjectCreator( String token) throws JSONException {
	log.error("Custom Auth Rule : Inside jsonObjectCreator()" );
		JSONObject obj=new JSONObject();
				obj.put("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
				obj.put("assertion", token);
		String json = obj.toString();
		log.error("Custom Auth Rule : The json object is " + json.toString() );
		return json;
	}
	
	
	
			 log.error("Custom Authentication : Rule Started");
	private static MediaType JSON= MediaType.parse("application/json; charset=utf-8");
	private static String SECRET_KEY = "<Secret Key>";

		String token= "";
        String jsonBody ="";
        String access_token="";
Map bodyMap = (Map) requestEndPoint.getBody();
		 try {
            token = generateToken();
            if(!token.isEmpty() || token !=null) {
					 log.error("Custom Authentication : JWT Assertion generated");
            	 jsonBody = jsonObjectCreator(token);
            }
            
            if(!jsonBody.isEmpty() || jsonBody !=null) {			
bodyMap.put("jsonBody", jsonBody);
            }
        }catch (JoseException e) {
			log.error("Custom Auth Rule : Exception occurred : " + e.toString());
		} catch (NoSuchAlgorithmException e) {
            log.error("Custom Auth Rule : Exception occurred : " + e.toString());
        } catch (InvalidKeySpecException e) {
            log.error("Custom Auth Rule : Exception occurred : " + e.toString());
        } catch (IOException e) {
            log.error("Custom Auth Rule : Exception occurred : " + e.toString());
        }catch (JSONException e) {
			 log.error("Custom Auth Rule : Exception occurred : " + e.toString());
		}finally {
           requestEndPoint.setBody(bodyMap);
			 log.error("Custom Authentication : In Finally block");
			return requestEndPoint;
        }
		
		 
		 ]]>
    </Source>
  </Rule>

```

---

<div class="post-metadata">

**Author:** ![cpatel](https://avatars.discourse-cdn.com/v4/letter/c/48db29/32.png) [@cpatel](https://developer.sailpoint.com/discuss/u/cpatel)\
**Post date:** [August 1, 2022, 4:20am UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/8 "2022-08-01T04:20:22Z")

</div>

I see you already have found out my thread from past: [WS JWT authentication](https://developer.sailpoint.com/discuss/t/ws-jwt-authentication/2986)

It is documented poorly in connector guide but what I mentioned should work.

---

<div class="post-metadata">

**Author:** ![chrisp](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@chrisp](https://developer.sailpoint.com/discuss/u/chrisp)\
**Post date:** [August 1, 2022, 12:29pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/9 "2022-08-01T12:29:47Z")

</div>

Thanks @cpatel .  
I think that will work for the 2 epoch dates, for iat, DO I need to add that in the JWT Payload? And if so, what do I put in for the value?

I think I’m still going to have to do a WebServiceBeforeOperationRule to update the Grant Type. The target system will only allow a grant type of ‘urn:ietf:params:oauth:grant-type:jwt-bearer’ and SailPoint seems to only allow a grant\_type of ‘JWT\_BEARER’

Thanks,  
Chris

---

<div class="post-metadata">

**Author:** ![chrisp](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@chrisp](https://developer.sailpoint.com/discuss/u/chrisp)\
**Post date:** [August 1, 2022, 12:30pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/10 "2022-08-01T12:30:39Z")

</div>

@tyler_mairose Thanks, It looks like that’s what I’ll need to use.

Where is that defined in the source? I’m looking at one of the web service sources, and I don’t see beforeOperationRule.

---

<div class="post-metadata">

**Author:** ![tyler\_mairose](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tyler_mairose/32/30112_2.png) [@tyler\_mairose](https://developer.sailpoint.com/discuss/u/tyler_mairose)\
**Post date:** [August 1, 2022, 2:41pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/11 "2022-08-01T14:41:33Z")

</div>

@chrisp,

You can create the rule with the connector rule API using the type `WebServiceBeforeOperationRule`. [create-connector-rule | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/beta/create-connector-rule)

The connector Rule API takes the script as escaped Java code. I use this tool to help me out with the formatting. [Free Online Java or .Net Escape / Unescape Tool - FreeFormatter.com](https://www.freeformatter.com/java-dotnet-escape.html#before-output)

Once created, you can take the name of the rule and use it in the PATCH Source API. [update-source | SailPoint Developer Community](https://developer.sailpoint.com/idn/api/v3/update-source)

> Replace [\*] with the index of operation. For example 0, 1, 2, etc. To get the index you can call the get Source API on your source and look at the operations under `/connectorAttributes/connectionParameters/`

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/connectionParameters/[*]/beforeRule",
        "value": "Example Rule"
    }
]

```

---

<div class="post-metadata">

**Author:** ![christosxygalidis](https://avatars.discourse-cdn.com/v4/letter/c/8797f3/32.png) [@christosxygalidis](https://developer.sailpoint.com/discuss/u/christosxygalidis)\
**Post date:** [November 22, 2022, 2:30pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/13 "2022-11-22T14:30:51Z")

</div>

Hi Tyler,

Can i ask something? from where do i take these values (issuer,aud\_value,scopes and Secret Key)  
claims.setClaim(“iss”,“issuer”);  
claims.setClaim(“aud”,“aud\_value”);  
claims.setClaim(“scope”,“scopes”);

private static String SECRET\_KEY = “Secret Key”;

Are these values static like plain text or are dynamic and we need to create these inside the code?

---

<div class="post-metadata">

**Author:** ![Augusto-Dallape](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Augusto-Dallape](https://developer.sailpoint.com/discuss/u/Augusto-Dallape)\
**Post date:** [January 23, 2023, 9:10pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/14 "2023-01-23T21:10:33Z")

</div>

Hey, while i did upload and replace the values inside the rule, im still getting that the iat and exp are not being defined nor replaced. Any ideas?

---

<div class="post-metadata">

**Author:** ![germanduci](https://avatars.discourse-cdn.com/v4/letter/g/b5e925/32.png) [@germanduci](https://developer.sailpoint.com/discuss/u/germanduci)\
**Post date:** [January 24, 2023, 3:12pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/15 "2023-01-24T15:12:07Z")

</div>

I’m having the same issue Augusto has explained in his reply, the iat and exp are not being defined nor replaced, have any info on this? Thanks.

---

<div class="post-metadata">

**Author:** ![tyler\_mairose](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tyler_mairose/32/30112_2.png) [@tyler\_mairose](https://developer.sailpoint.com/discuss/u/tyler_mairose)\
**Post date:** [January 24, 2023, 4:38pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/16 "2023-01-24T16:38:05Z")

</div>

Hello @Augusto-Dallape @germanduci,

The values for `iat` and `exp` are set to `unixTime` and `unixTime1` as shown in the above code.

Are you claiming that the values for `unixTime` and `unixTime1` are not being set? Could you provide more details or error logs?

Thanks,  
Tyler

---

<div class="post-metadata">

**Author:** ![tyler\_mairose](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tyler_mairose/32/30112_2.png) [@tyler\_mairose](https://developer.sailpoint.com/discuss/u/tyler_mairose)\
**Post date:** [January 24, 2023, 4:43pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/17 "2023-01-24T16:43:11Z")

</div>

Hello @christosxygalidis,

The issuer, aud\_value, scopes, and Secret Key are all static values that you will need to provide in the code.

Examples:

```auto
issuer: f687a4310ab23efe5e1ed6bcc98d213a9bffe6d27684db6450e0073e3249aca9
aud_value: https://sailpoint.com
scopes: admin_write admin_read

```

---

<div class="post-metadata">

**Author:** ![Augusto-Dallape](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Augusto-Dallape](https://developer.sailpoint.com/discuss/u/Augusto-Dallape)\
**Post date:** [January 24, 2023, 5:44pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/18 "2023-01-24T17:44:47Z")

</div>

Tyler,

We are trying to connect to google APIs, as you may know it requires both iat and exp values. While I did upload your code and replaced values: iss, aud, scope with the values i also replaced the secret key with the unecrypted secret key we are using in the json.

Problems arise when trying to execute a test connection. It still asks for the iat and exp values, so what i did is set random values to the iat and exp in the jwt payload just to debug. Error:  
_Exception occurred in Test Connection. Error: Exception occurred while generating access token: Unable to generate access token. Response returned: { “error”: “invalid\_grant”, “error\_description”: “Invalid JWT: Token must be a short-lived token (60 minutes) and in a reasonable timeframe. Check your iat and exp values and use a clock with skew to account for clock differences between systems.” }_

If i were to remove both iat and exp from the jwt payload i get a null pointer exception.

Here is the modified rule, attached to the test connection operation as a beforeRule: (Secret key is incomplete on purpose)

```auto
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.util.io.pem.PemObject;
import org.bouncycastle.util.io.pem.PemReader;
import org.jose4j.jws.JsonWebSignature;
import org.jose4j.jwt.JwtClaims;
import org.jose4j.lang.JoseException;
import org.json.JSONException;
import org.json.JSONObject;
import com.squareup.okhttp.MediaType;
import com.squareup.okhttp.OkHttpClient;
import com.squareup.okhttp.Request;
import com.squareup.okhttp.RequestBody;
import com.squareup.okhttp.Response;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.io.StringReader;
import java.net.HttpURLConnection;
import java.net.URL;
import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.interfaces.RSAPrivateKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Map;

		
		public String generateToken() throws NoSuchAlgorithmException, InvalidKeySpecException, IOException, JoseException {
        java.security.Security.addProvider(new BouncyCastleProvider());
		// Creating instance of PEM reader to get the Secret Key
		PemReader pemReader = new PemReader(new StringReader(SECRET_KEY));
		PemObject pemObject;
		pemObject = pemReader.readPemObject();

		//Getting the RSA instance for KeyFactory
		KeyFactory factory = KeyFactory.getInstance("RSA");
		byte[] content = pemObject.getContent();
		PKCS8EncodedKeySpec privKeySpec = new PKCS8EncodedKeySpec(content);
		RSAPrivateKey privateKey = (RSAPrivateKey) factory.generatePrivate(privKeySpec);

		//Getting the Unix time for UTC
		long unixTime = Instant.now().getEpochSecond();
		//Adding a minute to Unix time UTC

		long unixTime1 = Instant.now().plus(1, ChronoUnit.MINUTES).getEpochSecond();
	
			 JwtClaims claims = new JwtClaims();
			 claims.setClaim("iss","iam.gserviceaccount.com");
			 claims.setClaim("aud","https://oauth2.googleapis.com/token");
			 claims.setClaim("scope","https://www.googleapis.com/auth/admin.directory.user");
			 claims.setClaim("iat",unixTime);
			 claims.setClaim("exp",unixTime1);
			 
			 JsonWebSignature jws = new JsonWebSignature();
		        jws.setDoKeyValidation(false);
		        jws.setPayload(claims.toJson());
		        jws.setKey(privateKey);
		        jws.setAlgorithmHeaderValue("RS256");

		return jws.getCompactSerialization();
	}

	private String jsonObjectCreator( String token) throws JSONException {
	log.error("Custom Auth Rule : Inside jsonObjectCreator()" );
		JSONObject obj=new JSONObject();
				obj.put("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer");
				obj.put("assertion", token);
		String json = obj.toString();
		log.error("Custom Auth Rule : The json object is " + json.toString() );
		return json;
	}
	
	
	
			 log.error("Custom Authentication : Rule Started");
	private static MediaType JSON= MediaType.parse("application/json; charset=utf-8");
	private static String SECRET_KEY = "MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCYLpFaG/1U34So";

		String token= "";
        String jsonBody ="";
        String access_token="";
Map bodyMap = (Map) requestEndPoint.getBody();
		 try {
            token = generateToken();
            if(!token.isEmpty() || token !=null) {
					 log.error("Custom Authentication : JWT Assertion generated");
            	 jsonBody = jsonObjectCreator(token);
            }
            
            if(!jsonBody.isEmpty() || jsonBody !=null) {			
bodyMap.put("jsonBody", jsonBody);
            }
        }catch (JoseException e) {
			log.error("Custom Auth Rule : Exception occurred : " + e.toString());
		} catch (NoSuchAlgorithmException e) {
            log.error("Custom Auth Rule : Exception occurred : " + e.toString());
        } catch (InvalidKeySpecException e) {
            log.error("Custom Auth Rule : Exception occurred : " + e.toString());
        } catch (IOException e) {
            log.error("Custom Auth Rule : Exception occurred : " + e.toString());
        }catch (JSONException e) {
			 log.error("Custom Auth Rule : Exception occurred : " + e.toString());
		}finally {
           requestEndPoint.setBody(bodyMap);
			 log.error("Custom Authentication : In Finally block");
			return requestEndPoint;
        }

```

![image](https://global.discourse-cdn.com/sailpoint/original/2X/1/124042a8c6cb78be2fea5ab1c3ef739783fc651b.png)

Hope this helps,

Greetings

---

<div class="post-metadata">

**Author:** ![tyler\_mairose](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/tyler_mairose/32/30112_2.png) [@tyler\_mairose](https://developer.sailpoint.com/discuss/u/tyler_mairose)\
**Post date:** [January 24, 2023, 7:44pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/19 "2023-01-24T19:44:32Z")

</div>

@Augusto-Dallape,

Thank you for the additional details!

Looking at the docs for Google oauth2, this error can be related to the system time being off. Can you check your VA system time? [Google oauth2](https://developers.google.com/identity/protocols/oauth2/service-account#error-codes)

I will continue to dig into why you are seeing this error.

---

<div class="post-metadata">

**Author:** ![Augusto-Dallape](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Augusto-Dallape](https://developer.sailpoint.com/discuss/u/Augusto-Dallape)\
**Post date:** [January 25, 2023, 2:51am UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/20 "2023-01-25T02:51:50Z")

</div>

I tried building the connector again but with custom auth, thus the rule is being ran. But its giving me an error on line 80 where the MediaType namespace could not be defined. I removed that line since i believe its not being used in the code, but now the rule just seems to be skipping something, im getting a 401 forbidden from google apis.

Any thoughts?

Thanks!

---

<div class="post-metadata">

**Author:** ![Augusto-Dallape](https://avatars.discourse-cdn.com/v4/letter/a/d26b3c/32.png) [@Augusto-Dallape](https://developer.sailpoint.com/discuss/u/Augusto-Dallape)\
**Post date:** [January 25, 2023, 6:37pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/21 "2023-01-25T18:37:34Z")

</div>

After more troubleshooting are you sure bouncycastle, jose4j are defined inside IdentityNow? The rule not even seems to be executed because no logging is made in ccg.log

Thanks!

---

<div class="post-metadata">

**Author:** ![jdnyt](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@jdnyt](https://developer.sailpoint.com/discuss/u/jdnyt)\
**Post date:** [July 10, 2023, 7:47pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/22 "2023-07-10T19:47:02Z")

</div>

> [@chrisp](#):
>
> 6000

Any luck with this? Having same issue/need.  
Thanks

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [September 8, 2023, 7:47pm UTC](https://developer.sailpoint.com/discuss/t/oauth-verification-for-jwt-payload/5177/23 "2023-09-08T19:47:35Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.