JWT 401 unauthorized

[LorisLombardo87]

Hi all,

i'm trying to login to qlik using a JWT token but when i try to post to https://horsadev.eu.qlikcloud.com/login/jwt-session with the the web integration id and the bearer token i get the following error.

the token is made up like this:

user details: name sub and email are the exactly like the console.

any idea of what can go wrong here?

thanks,

Loris

[LorisLombardo87]

Hi Alex, Sure!

the http request is as follow:

 async jwtLogin(token: string) {
    const authHeader = `Bearer ${token}`;
    return await fetch(`https://${environment.QlikTenant}/login/jwt-session?qlik-web-integration-id=${environment.webIntegrationID}`, {
      credentials: 'include',
      mode: 'cors',
      method: 'POST',
      headers: {
        'Authorization': authHeader,
        'qlik-web-integration-id': environment.webIntegrationID,
        'Content-Type': 'application/json'
      },
    })
  }

the IdP configuration is very simple:
 

issuer and keyid have been left blank at the moment of creation, the one you see have been automatically populated by the console, and are matching what's in the JWT.

thanks for the support,

Loris

[alex_colombo]

You don't need the webintegration id, mode:CORS and credential: include. Could you please remove them and try again. Also, try to compare my request with yours and di exactly the same, it should work.

[LorisLombardo87]

Thanks Alex, still the same. unfortunately.

can you please also double check if what MPC what suggesting a few comments earlier about the sub here  is correct ?

thanks

[alex_colombo]

You have to use the IdP subject.
I have just tried with Postam (I guess you are using Postman) and it works. The only thing that I see here is that there is something in the certificate which you are using for generate the token, maybe a mismatch between it and the private key set in IdP configuration in MC.

Could you please check this step in JWT configuration and check if you have remove any carriage returns or line feeds existing in the text?

[LorisLombardo87]

Hi Alex, we have decided to switch to SAML.

unfortunately all the suggestions have been ineffective.

[alex_colombo]

I strongly reccomend to open a support case about this.