Okta SDK group api issue using PrivateKey

Questions
1

I was able to use Okta SDK for .net using api token, but was not able to use private key. Looks like api tokens expire if not used for 30 days.

I followed the example on creating keys and creating service api in okta, but keep getting this error message:

System.InvalidOperationException: Something went wrong when creating the signed JWT. Verify your private key.
—> System.InvalidOperationException: IDX10638: Cannot create the SignatureProvider, ‘key.HasPrivateKey’ is false, cannot create signatures. Key: Microsoft.IdentityModel.Tokens.JsonWebKey, Use: ‘’, Kid: ‘ga5fHGG56WYOfa_dCRBUcJ-2ZhH-3f9BhVOlK3bMmxs’, Kty: ‘RSA’, InternalId: ‘’…
at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider…ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures)
at Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider…ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures, CryptoProviderFactory cryptoProviderFactory)
at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateSignatureProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures, Boolean cacheProvider)
at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForSigning(SecurityKey key, String algorithm, Boolean cacheProvider)
at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForSigning(SecurityKey key, String algorithm)
at Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities.CreateEncodedSignature(String input, SigningCredentials signingCredentials)
at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.WriteToken(SecurityToken token)
at Okta.Sdk.Client.DefaultJwtGenerator.GenerateSignedJWT()

2

Did you configure the application within Okta to have a Private/Public key pair?

3

I did configure the private/public key in okta. This is the sample I followed:

var privateKey = new JsonWebKeyConfiguration
{
P = “{{P}}”,
Kty = “RSA”,
Q = “{{Q}}”,
D = “{{D}}”,
E = “{{E}}”,
Kid = “{{P}}”,
Qi = “{{Qi}}”
};

var configuration = new Configuration
{
OktaDomain = “https://{{yourOktaDomain}}”,
AuthorizationMode = AuthorizationMode.PrivateKey,
ClientId = “{{clientId}}”,
Scopes = new List { “okta.users.read”, “okta.apps.read”, “okta.groups.manage”, “okta.groups.manage” }, // Add all the scopes you need
PrivateKey = privateKey
};

services.AddScoped(_ => new GroupApi(configuration ));

I get NullReferenceException on this line: services.AddScoped(_ => new GroupApi(configuration ));

4

Hey there, first of all Yes, Okta tokens expire within 30 days, and as for the private key issue, there could be something wrong with the key itself or how it’s being used. You should double-check if the key is in the right format matching the public key. And in my personal experience, I had this issue once with a client’s project at Triotech Systems we also contacted the support team at Okta. It was about the wrong format. I hope that makes things clear. If not you can always reach out.

5

Thank you for your response. It would be nice to have someone from OKTA to comment on this. If you enable null reference settings within Visual Studio 2022 exception handling settings window then the null reference exceptions are raised repeatedly on the line shown above. Eventually code gets executed after throwing ton of null reference exceptions.

6 
Hey, Activating the null reference option in Visual Studio 2022 might cause the specified code to throw the error frequently. If your code has unresolved null references, you may anticipate this behavior.
7

The NullReferenceException doesn’t happen when using API token, it only happens when using PrivateKey option instead of API token option.

I also noticed the following issue: Okta SDK group api issue using PrivateKey - Questions - Okta Developer Community.
This one happens when I attempt to use yaml file with privateKey option instead of hard coded example for the okta configuration. Could you please provide an example format for specifying Scopes in okta.yaml file with multiple scopes like okta.groups.read, okta.groups.manage? Should there be quotes, spaces or any specific requirements for okta.yaml file?

Here is the reference file I used:

okta:
client:
connectionTimeout: 30000 # milliseconds
oktaDomain: “https://{yourOktaDomain}”
proxy:
port: null
host: null
username: null
password: null
authorizationMode: “PrivateKey”
clientId: “{yourClientId}”
Scopes:
- scope1
- scope2
PrivateKey:
“p”: “{p}”
“kty”: “RSA”
“q”: “{q}”
“d”: “{d}”
“e”: “{e}”
“kid”: “{kid}”
“qi”: “{qi}”
requestTimeout: 0 # milliseconds
rateLimit:
maxRetries: 4

I didn’t have any issues when I used okta.yaml configuration file with API token:
okta:
client:
connectionTimeout: 30000 # milliseconds
oktaDomain: “https://{yourOktaDomain}”
proxy:
port: null
host: null
username: null
password: null
token: {apiToken}
requestTimeout: 0 # milliseconds
rateLimit:
maxRetries: 4

The only difference between these okta.yaml file options, looks like Scopes and PrivateKey in case of private key usage.

I used okta console to generate RSA public/private key pairs and replaced private key settings values with private key actual values in the above okta.yaml file.

8

The NullReferenceException doesn’t happen when using API token, it only happens when using PrivateKey option instead API token. Just to be clear the exceptions are thrown at the Okta.Sdk code around the creation of the GroupApi or UserApi in the constructor with a Configuration object parameter.

I also noticed the following issue: Okta SDK group api issue using PrivateKey - Questions - Okta Developer Community.
This one happens when I attempt to use yaml file with privateKey option instead of hard coded example for the okta configuration. Could you please provide an example format for specifying Scopes in okta.yaml file with multiple scope like okta.groups.read, okta.groups.manage? Should there be quotes, spaces or any specific requirements for okta.yaml?