# Unable to authenticate token with JWK set

**URL:** <https://devforum.okta.com/t/unable-to-authenticate-token-with-jwk-set/6081>\
**Category:** Questions\
**Tags:** spring, angular\
**Created:** [August 27, 2019, 6:59am UTC](https://devforum.okta.com/t/unable-to-authenticate-token-with-jwk-set/6081 "2019-08-27T06:59:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gagan\_shah](https://avatars.discourse-cdn.com/v4/letter/g/a5b964/32.png) [@gagan\_shah](https://devforum.okta.com/u/gagan_shah)\
**Post date:** [August 27, 2019, 6:59am UTC](https://devforum.okta.com/t/unable-to-authenticate-token-with-jwk-set/6081/1 "2019-08-27T06:59:45Z")

</div>

Hello There,

We are facing a strange issue while authenticating.

When we authenticate from our [dev-XXXX-admin.okta.com](http://dev-XXXX-admin.okta.com) account, then we a re able redirect back to our application (running on https://).  
But when we configure actual URL provided by client, then we are getting below error.

```auto
WWW-Authenticate: Bearer error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Couldn't retrieve remote JWK set: org.springframework.web.client.HttpClientErrorException$NotFound: 404 Not Found", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"

```

**Server Logs:**

```auto
2019-08-21 06:17:24.717 [https-jsse-nio-443-exec-3] DEBUG ip-172-31-15-102 --- [-nio-443-exec-3] o.s.s.a.ProviderManager : Authentication attempt using org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider
2019-08-21 06:17:24.717 [https-jsse-nio-443-exec-3] DEBUG ip-172-31-15-102 --- [-nio-443-exec-3] o.s.w.c.RestTemplate : HTTP GET https://averydennison.okta.com/oauth2/v1/authorize/v1/keys
2019-08-21 06:17:24.718 [https-jsse-nio-443-exec-3] DEBUG ip-172-31-15-102 --- [-nio-443-exec-3] o.s.w.c.RestTemplate : Accept=[text/plain, application/json, application/*+json, */*]
2019-08-21 06:17:24.895 [https-jsse-nio-443-exec-3] DEBUG ip-172-31-15-102 --- [-nio-443-exec-3] o.s.w.c.RestTemplate : Response 404 NOT_FOUND
2019-08-21 06:17:24.900 [https-jsse-nio-443-exec-3] DEBUG ip-172-31-15-102 --- [-nio-443-exec-3] .s.a.DefaultAuthenticationEventPublisher : No event was found for the exception org.springframework.security.oauth2.core.OAuth2AuthenticationException
2019-08-21 06:17:24.900 [https-jsse-nio-443-exec-3] DEBUG ip-172-31-15-102 --- [-nio-443-exec-3] .o.s.r.w.BearerTokenAuthenticationFilter : Authentication request for failed: org.springframework.security.oauth2.core.OAuth2AuthenticationException: An error occurred while attempting to decode the Jwt: Couldn't retrieve remote JWK set: org.springframework.web.client.HttpClientErrorException$NotFound: 404 Not Found

```

**[https://github.com/okta/okta-spring-boot](https://github.com/okta/okta-spring-boot)** (followed this reference code)  
Am not able to find out actual root cause.

We are using Angular-8 and Spring Boot-2.x.

```java
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	
	@Override
	protected void configure(HttpSecurity http) throws Exception {
	    http.cors().and().authorizeRequests().anyRequest().authenticated().and().oauth2ResourceServer().jwt();
	}
}

```

application.properties:

```auto
oktaOrgUrl=https://averydennison.okta.com
oktaApiToken=<api-token>
okta.oauth2.issuer=https://averydennison.okta.com/oauth2/v1/authorize
okta.oauth2.redirect-uri=/implicit/callback
okta.oauth2.audience=api://default
okta.oauth2.client-id=0oa1hhdpgukI7pNl90h8
spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://averydennison.okta.com.okta.com/oauth2/0oa1hhdpgukI7pNl90h8/v1/keys

```

---

<div class="post-metadata">

**Author:** ![bdemers](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/bdemers/32/23_2.png) [@bdemers](https://devforum.okta.com/u/bdemers)\
**Post date:** [August 28, 2019, 1:31pm UTC](https://devforum.okta.com/t/unable-to-authenticate-token-with-jwk-set/6081/2 "2019-08-28T13:31:48Z")

</div>

Hey @gagan_shah!

It looks like your issuer is wrong, it should likely be:  
[https://averydennison.okta.com/oauth2/0oa1hhdpgukI7pNl90h8](https://averydennison.okta.com/oauth2/0oa1hhdpgukI7pNl90h8)  
(based on your other config)

I’m guessing based on your question you only need the properties:

- oktaOrgUrl
- oktaApiToken
- okta.oauth2.issue

You can also inject the SDK client as well: [GitHub - okta/okta-spring-boot: Okta Spring Boot Starter](https://github.com/okta/okta-spring-boot#inject-the-okta-java-sdk)

> NOTE: you included your API key, in this post, you should revoke it

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 17, 2024, 11:58pm UTC](https://devforum.okta.com/t/unable-to-authenticate-token-with-jwk-set/6081/3 "2024-01-17T23:58:38Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.