OAuth for Okta with a service app with JWT

[angelnar87]

Hello there! Has anyone run into an issue where a service app setup to use jwt is unable to be granted okta.apps.read scope?

Here are the basic steps I’m following.

0. Grant the “okta.apps.manage” scope to the service app
1. Configure the public key in the service app
2. Sign the payload. ie with the private key
   {
   “aud”: “https://{okta-domain}/oauth2/v1/token”,
   “iss”: “{client_id}”,
   “sub”: “{client_id}”,
   “exp”: “1715031183060”
   }
3. Retrieve the token from https://{okta-domain}/oauth2/v1/token by configuring these headers:
   client_assertion_type = urn:ietf:params:oauth:client-assertion-type:jwt-bearer
   client_assertion = signed payload
   scope = okta.apps.manage
4. Successfully retrieves bearer token from step 3
5. Make a request to https://{okta-domain}/api/v1/apps
6. Okta returns with an error message like this:
   {
   “errorCode”: “E0000006”,
   “errorSummary”: “You do not have permission to perform the requested action”,
   “errorLink”: “E0000006”,
   “errorCauses”:
   }

Interestingly, if I try the same with okta.users.manage, it will return an empty list of users instead of a 403 error.

Any thoughts? TIA

[andrea]

What Admin Role(s) did you grant your Service app?

[angelnar87]

Hi Andrea,

I don’t think I actually did that. Is there a way to do that through the UI? or does it have to be through the POST /oauth2/v1/clients/${yourServiceAppId}/roles ??

[angelnar87]

This solved my problem