Google Api 服务帐户“错误”：“invalid_grant”，“error_description”：“JWT 签名无效。”

Question

I am pretty new with google api, but I already spent 6 hours with this error. So I want to access my google drive files with a service account. But I always get this error:

{"error":"invalid_grant","error_description":"Invalid JWT Signature."}

This is the method I create and send the JWT in NodeJs:

const privateKeyFile = require("./user.json");
const base64url = require("base64url");
const jsonwebtoken = require("jsonwebtoken");
const querystring = require("querystring");
const request = require("request");

// HEADER
let header = { alg: "RS256", typ: "JWT" };
let encodedH = base64url(JSON.stringify(header));

// CLAIM SET
let exp = parseInt(Date.now() / 1000) + 60 * 20;
// issue time
let iat = parseInt(Date.now() / 1000);
let claimset = {
  iss: "*********@*******.iam.gserviceaccount.com",
  scope: "https://www.googleapis.com/auth/drive",
  aud: "https://oauth2.googleapis.com/token",
  exp: exp,
  iat: iat,
};
let encodedCs = base64url(JSON.stringify(claimset));


// create signiture
let signitureBase = encodedH + "." + encodedCs;
jsonwebtoken.sign(
  signitureBase,
  privateKeyFile.private_key,
  {
    algorithm: "RS256",
    header: header,
  },
  function (err, signature) {
    request.post(
      "https://oauth2.googleapis.com/token",
      {
        headers: { "Content-Type": "application/x-www-form-urlencoded" },
        body: querystring.encode({
          grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
          assertion: signitureBase + "." + base64url(signature),
        }),
      },
      function (error, response) {
        console.log(error);
        console.log(response);
      }
    );
  }
);

Thanks in advance!

Answer 1

I believe your goal as follows.

• You want to retrieve the access token from the Google service account using Node.js.

For this, how about this answer?

Pattern 1:

In this pattern, crypto and request are used.

Sample script:

const privateKeyFile = require("./user.json");
const cryptor = require("crypto");
const request = require("request");

const scopes = ["https://www.googleapis.com/auth/drive"];
const url = "https://www.googleapis.com/oauth2/v4/token";
const header = {
  alg: "RS256",
  typ: "JWT",
};
const now = Math.floor(Date.now() / 1000);
const claim = {
  iss: privateKeyFile.client_email,
  scope: scopes.join(" "),
  aud: url,
  exp: (now + 3600).toString(),
  iat: now.toString(),
};

const signature =
  Buffer.from(JSON.stringify(header)).toString("base64") +
  "." +
  Buffer.from(JSON.stringify(claim)).toString("base64");
var sign = cryptor.createSign("RSA-SHA256");
sign.update(signature);
const jwt = signature + "." + sign.sign(privateKeyFile.private_key, "base64");

request(
  {
    method: "post",
    url: url,
    body: JSON.stringify({
      assertion: jwt,
      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
    }),
  },
  (err, res, body) => {
    if (err) {
      console.log(err);
      return;
    }
    console.log(body);
  }
);

Result:

When you run the script, the following result is retrieved.

{
  "access_token": "###",
  "expires_in": ####,
  "token_type": "Bearer"
}

Pattern 2:

In this pattern, googleapis is used.

Sample script:

const privateKeyFile = require("./user.json");
const { google } = require("googleapis");

let jwtClient = new google.auth.JWT(
  privateKeyFile.client_email,
  null,
  privateKeyFile.private_key,
  ["https://www.googleapis.com/auth/drive"]
);
jwtClient.authorize((err) => {
  if (err) console.log(err);
});
jwtClient.getRequestHeaders().then((auth) => {
  console.log(auth);
});

Result:

When you run the script, the following result is retrieved.

{
  "Authorization": "Bearer ###"
}

Reference:

• googleapis for Node.js