Invalid JWT signature

[deepanshugarg09]

Hi, 

I am quite new to GCP and have a use case where i need to access Google Drive content via service account. In order to do that I need access token and for access token I need a valid JWT token.

I could generate a valid JWT token using python which uses google.auth.crypt package to sign JWT using service account key file.

Same when I tried in C++ using openssl and private key from service account file, it does not work and throws error "Ïnvalid JWT Signature".

Please help if someone can help.

[Roderick]

Interesting use case here! Did you find a native solution or workaround to this? @deepanshugarg09 

[lawrencenelson · Accepted solution]

Hi @deepanshugarg09,

Welcome to the Google Cloud Community!

First, ensure that your Python code is correctly set up to authenticate using the service account. A common cause of such authentication errors is often related to either the environment variables not being properly set or issues in the configuration method used when calling the service account like from this StackOverflow thread - Why am I getting "invalid_grant: Invalid JWT Signature" with Google's Python TTS example?.

Verify that all required environment variables are correctly set in your development or production environment. This includes the path to your service account key file and any other variables that your application depends on for authentication. For instance, if you're using the GOOGLE_APPLICATION_CREDENTIALS environment variable, ensure it points to the correct JSON key file for your service account:

export GOOGLE_APPLICATION_CREDENTIALS="/path/to/your/service-account-file.json"

Second, review how you're configuring the authentication in your Python code. Make sure you're using the appropriate method from the Google Cloud client library to authenticate with your service account. For example, if you're using the google-auth library, your code should initialize the credentials object correctly and pass it to the client service you're trying to access [1].

Alternatively, Domain-Wide Delegation can also be a solution, especially if you're operating within a Google Workspace domain. By enabling DWD, you can seamlessly impersonate users within your organization, allowing the service account to access Google Drive content on their behalf without individual user authentication each time [2]. 

To implement domain-wide delegation, you'd start by enabling DWD for the service account in the Google Cloud Console and then authorize the required Google Drive API scopes via the Google Workspace Admin console. You may review this documentation for more information - Set up domain-wide delegation for a client.

I hope this helps. Thank you.

[1]. https://stackoverflow.com/questions/77361750/error-when-i-use-google-service-account-invalid-jwt

[2]. https://support.google.com/a/answer/162106?hl=en