Invalid token response - jwt-generator

mvolpe-fvg commented 3 months ago

Salve,

La richiesta di validazione ritorna invalid token, anche se il toke è stato generato con l'apposito tool jwt-generator.

Comando Curl:

curl.exe --cert-type P12 --cert C:\A1#111#TECHEMVSRLXX.p12:'password' -X 'POST' 'https://modipa-val.fse.salute.gov.it:443/govway/rest/in/FSE/gateway/v1/documents/validation' -H 'Authorization: Bearer eyJ4NWMiOlsiTUlJRmJEQ0NBMVNnQXdJQkFnSVVCZlhpeVlTdGNVMjRDWGJqSUNJSmI0UmdOaW93RFFZSktvWklodmNOQVFFTEJRQXdWekVuTUNVR0ExVUVBd3dlUTBFZ1RXbHVhWE4wWlhKdklHUmxiR3hoSUZOaGJIVjBaU0JVWlhOME1SOHdIUVlEVlFRS0RCWk5hVzVwYzNSbGNtOGdaR1ZzYkdFZ1UyRnNkWFJsTVFzd0NRWURWUVFHRXdKSlZEQWVGdzB5TkRBMU1ETXhORFV4TURGYUZ3MHlOekExTURReE5EVXhNREJhTUcweEN6QUpCZ05WQkFZVEFrbFVNUjh3SFFZRFZRUUtEQlpOYVc1cGMzUmxjbThnWkdWc2JHRWdVMkZzZFhSbE1SOHdIUVlEVlFSaERCWkRSanBKVkMxUVVrOVdRVmd3TUZnd01GZ3dNREJaTVJ3d0dnWURWUVFEREJOVE1TTXhNVEVqVkVWRFNFVk5WbE5TVEZoWU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBczB4eDQzVk1SUFlCUVpLQTlqTUdFMTdCOEF1Ryt6Q3ltK2dwalRtN0ovZDRlK2plUDBCalVkYkN0TDYxTmJsQmhuSzAybzdLZ3luRU1NMVJWOVkvTzczbks5OXM1d3Jnb3p0SU5QcncwMHA5dmVTMFhHVE9CaUlEbDJDTTcwTWQ2QlJjMG45N1hMcEYwejNtVjBZUkdISjMwdnNjR1Zqa3FZdW80Qjk3REJWYk92N0RKMjdRN0Rob0ZQZTluSURKeXIzWndJMmc2U25ML0Uyc1ZMWXdTYk1HaXNXNlpNR0dZNVZsVXBicHkwTVZobVlBRlJySmlPRU9HVEpaMmhHUXFoaVVaNFU5Y0N3cXhqV3BuTWRrS2NCZDY2NUc5bjZ1Wi9lb1JqYmJSdWd3bnBaRFdiSFFGR0JHR0Jyc1NRaysxZDFrbDk1aXBqb21uRkJyZGw1Um13SURBUUFCbzRJQkdEQ0NBUlF3SHdZRFZSMGpCQmd3Rm9BVUZqbXBHZ1dKdHc4dHNqWHR3Z21heFFPRElqOHdFZ1lEVlIwZ0JBc3dDVEFIQmdVclRCMEJDekNCclFZRFZSMGZCSUdsTUlHaU1JR2ZvSUdjb0lHWmhvR1dhSFIwY0hNNkx5OWpZWE52WjJWcGMzWnBiQzV6YjJkbGFTNXBkQzlsYW1KallTOXdkV0pzYVdOM1pXSXZkMlZpWkdsemRDOWpaWEowWkdsemREOWpiV1E5WTNKc0ptbHpjM1ZsY2oxRFRpVXpSRU5CSzAxcGJtbHpkR1Z5Ynl0a1pXeHNZU3RUWVd4MWRHVXJWR1Z6ZENVeVEwOGxNMFJOYVc1cGMzUmxjbThyWkdWc2JHRXJVMkZzZFhSbEpUSkRReVV6UkVsVU1CMEdBMVVkRGdRV0JCUnYxZXJlRmNuSHlSbS95THhoNEUxM3JNWEcvREFPQmdOVkhROEJBZjhFQkFNQ0JrQXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBSWtDQWFBQzRIUVdUVlFIcTh4N2RKUVNPNVJueWlpTVVVVEtKZjUrYWQ2VkJsMkxxOEJTMXRWQXNicFZnQ2RqZzRFQUh2aUNTUHR3T0hwUHhVUFBmL0pJRUVHYmM0VG1KcDB2MVVQOXlIZVRFemRlaWdnQlNrRGdEZmVoNHdGdjRoeHlHWHhtRXRGTW5FZkhwYzdMTk52U3VlZkRmMXE3b0F3bHJ4eW9INGJwMFVySGo5UmF3aCtWUC8xYmVLWDFuVnZ1RkY3eW5EdGZEVUQzbzluOWZGMnRYQ3dmcjIwSzRrUDUxVmxuang4bStGSVU5Z1lpTEp5QzR0T0RyUzdDZlJIdmZZZTRVOE9Pa01mdUUyL0puK2REdnc0VjJNZDhXTmkyOUVBVEV2U0F1dlRqMWYxOVh2aUdZNjBGTXh1dlNaZHl0cmpSamRRN3l6LzQyM0JOQUFrdzhKcW1IdWN0bUVCU2dLYmJlVUw2U2RJRkhjelhyZ3ByWFJVbUFtcUJ3Ym9maWcvRmJvWVgxQ1RGdTlTWlM1aTBOU3h5MjRCalk5cDl5Tk5tRXhOY3c4Z0FjckdET2g0OUo3WU1qWVBseHBLNWVMSEw3RCtabUxsT09nU3pnTkJ0bmFvazIrT2tsd3pJVE9FSlBOYzBCWjlLRHBnMVRZUHBGdllaVm1mTWczTkJGbkJCOGlKOVk5dWVvcFpXWFNQdE8wOTFPS1E3NG1QR3RCa01ycUlMY2R0Mm9XM1p2akNoNCt3aVF0NlVBZWNQVFlpSUlnU3J6d2U3K2N3Vm1UMFFkSUZDSm9tNmRoU3E4WFg1Q1BwSTJvQkIwK2t3MXVzNi9FL3RXbjZFY2ZVbXBaV21sNTFSUGVabFZ3QmVJQXAzUVdaR2NUbkR1bXZRMWxSK0ltakgiXSwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJQR0dNUlo3MEQwMUQ5NjlPXl5eJjIuMTYuODQwLjEuMTEzODgzLjIuOS40LjMuMiZJU08iLCJhdWQiOiJodHRwczovL21vZGlwYS12YWwuZnNlLnNhbHV0ZS5nb3YuaXQvZ292d2F5L3Jlc3QvaW4vRlNFL2dhdGV3YXkvdjEiLCJpc3MiOiJhdXRoOlMxIzExMSNURUNIRU1WU1JMWFgiLCJleHAiOjE3MjEyOTY1NDYsImlhdCI6MTcyMTI5Mjk0NiwianRpIjoiMTcxNTMyOTgzMCJ9.XWpXPMKE7_n-CIUHRJA1qORx5LLZsKPdh0hu_wlCFrH8jyULQ8-FrJyDWrFoVg5_-6iIZY9AyHWIuagzHQUS6UVRJkao-EDlamHiy2JtH9nWnKoeTwp2y-Jc5ED9w8_Abxj9oGu9b-p0GrxufKy23wc3-GHqUbGKgwHVSduD6oE6AojCPa87oYW_lmfP1YHeH8WXzVelejmrkoZxdnZ294CsWslC0CCZijl-RvGzxOyW8adP5He-hw3t7Tf-3hTBXDimMnN0Y9bphpvWuZY5WbS1NwWDZizdmWvBBkxq8OHKxph_QWjNdfzuWDPu_3B3-WYiQ1KBJjXhJHXAJhcQbA' -H 'FSE-JWT-Signature: eyJ4NWMiOlsiTUlJRmJEQ0NBMVNnQXdJQkFnSVVCZlhpeVlTdGNVMjRDWGJqSUNJSmI0UmdOaW93RFFZSktvWklodmNOQVFFTEJRQXdWekVuTUNVR0ExVUVBd3dlUTBFZ1RXbHVhWE4wWlhKdklHUmxiR3hoSUZOaGJIVjBaU0JVWlhOME1SOHdIUVlEVlFRS0RCWk5hVzVwYzNSbGNtOGdaR1ZzYkdFZ1UyRnNkWFJsTVFzd0NRWURWUVFHRXdKSlZEQWVGdzB5TkRBMU1ETXhORFV4TURGYUZ3MHlOekExTURReE5EVXhNREJhTUcweEN6QUpCZ05WQkFZVEFrbFVNUjh3SFFZRFZRUUtEQlpOYVc1cGMzUmxjbThnWkdWc2JHRWdVMkZzZFhSbE1SOHdIUVlEVlFSaERCWkRSanBKVkMxUVVrOVdRVmd3TUZnd01GZ3dNREJaTVJ3d0dnWURWUVFEREJOVE1TTXhNVEVqVkVWRFNFVk5WbE5TVEZoWU1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBczB4eDQzVk1SUFlCUVpLQTlqTUdFMTdCOEF1Ryt6Q3ltK2dwalRtN0ovZDRlK2plUDBCalVkYkN0TDYxTmJsQmhuSzAybzdLZ3luRU1NMVJWOVkvTzczbks5OXM1d3Jnb3p0SU5QcncwMHA5dmVTMFhHVE9CaUlEbDJDTTcwTWQ2QlJjMG45N1hMcEYwejNtVjBZUkdISjMwdnNjR1Zqa3FZdW80Qjk3REJWYk92N0RKMjdRN0Rob0ZQZTluSURKeXIzWndJMmc2U25ML0Uyc1ZMWXdTYk1HaXNXNlpNR0dZNVZsVXBicHkwTVZobVlBRlJySmlPRU9HVEpaMmhHUXFoaVVaNFU5Y0N3cXhqV3BuTWRrS2NCZDY2NUc5bjZ1Wi9lb1JqYmJSdWd3bnBaRFdiSFFGR0JHR0Jyc1NRaysxZDFrbDk1aXBqb21uRkJyZGw1Um13SURBUUFCbzRJQkdEQ0NBUlF3SHdZRFZSMGpCQmd3Rm9BVUZqbXBHZ1dKdHc4dHNqWHR3Z21heFFPRElqOHdFZ1lEVlIwZ0JBc3dDVEFIQmdVclRCMEJDekNCclFZRFZSMGZCSUdsTUlHaU1JR2ZvSUdjb0lHWmhvR1dhSFIwY0hNNkx5OWpZWE52WjJWcGMzWnBiQzV6YjJkbGFTNXBkQzlsYW1KallTOXdkV0pzYVdOM1pXSXZkMlZpWkdsemRDOWpaWEowWkdsemREOWpiV1E5WTNKc0ptbHpjM1ZsY2oxRFRpVXpSRU5CSzAxcGJtbHpkR1Z5Ynl0a1pXeHNZU3RUWVd4MWRHVXJWR1Z6ZENVeVEwOGxNMFJOYVc1cGMzUmxjbThyWkdWc2JHRXJVMkZzZFhSbEpUSkRReVV6UkVsVU1CMEdBMVVkRGdRV0JCUnYxZXJlRmNuSHlSbS95THhoNEUxM3JNWEcvREFPQmdOVkhROEJBZjhFQkFNQ0JrQXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnSUJBSWtDQWFBQzRIUVdUVlFIcTh4N2RKUVNPNVJueWlpTVVVVEtKZjUrYWQ2VkJsMkxxOEJTMXRWQXNicFZnQ2RqZzRFQUh2aUNTUHR3T0hwUHhVUFBmL0pJRUVHYmM0VG1KcDB2MVVQOXlIZVRFemRlaWdnQlNrRGdEZmVoNHdGdjRoeHlHWHhtRXRGTW5FZkhwYzdMTk52U3VlZkRmMXE3b0F3bHJ4eW9INGJwMFVySGo5UmF3aCtWUC8xYmVLWDFuVnZ1RkY3eW5EdGZEVUQzbzluOWZGMnRYQ3dmcjIwSzRrUDUxVmxuang4bStGSVU5Z1lpTEp5QzR0T0RyUzdDZlJIdmZZZTRVOE9Pa01mdUUyL0puK2REdnc0VjJNZDhXTmkyOUVBVEV2U0F1dlRqMWYxOVh2aUdZNjBGTXh1dlNaZHl0cmpSamRRN3l6LzQyM0JOQUFrdzhKcW1IdWN0bUVCU2dLYmJlVUw2U2RJRkhjelhyZ3ByWFJVbUFtcUJ3Ym9maWcvRmJvWVgxQ1RGdTlTWlM1aTBOU3h5MjRCalk5cDl5Tk5tRXhOY3c4Z0FjckdET2g0OUo3WU1qWVBseHBLNWVMSEw3RCtabUxsT09nU3pnTkJ0bmFvazIrT2tsd3pJVE9FSlBOYzBCWjlLRHBnMVRZUHBGdllaVm1mTWczTkJGbkJCOGlKOVk5dWVvcFpXWFNQdE8wOTFPS1E3NG1QR3RCa01ycUlMY2R0Mm9XM1p2akNoNCt3aVF0NlVBZWNQVFlpSUlnU3J6d2U3K2N3Vm1UMFFkSUZDSm9tNmRoU3E4WFg1Q1BwSTJvQkIwK2t3MXVzNi9FL3RXbjZFY2ZVbXBaV21sNTFSUGVabFZ3QmVJQXAzUVdaR2NUbkR1bXZRMWxSK0ltakgiXSwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJQR0dNUlo3MEQwMUQ5NjlPXl5eJjIuMTYuODQwLjEuMTEzODgzLjIuOS40LjMuMiZJU08iLCJzdWJqZWN0X3JvbGUiOiJBQVMiLCJwdXJwb3NlX29mX3VzZSI6IlRSRUFUTUVOVCIsImlzcyI6ImludGVncml0eTpTMSMxMTEjVEVDSEVNVlNSTFhYIiwibG9jYWxpdHkiOiI5MjUwMzA5MjUiLCJzdWJqZWN0X2FwcGxpY2F0aW9uX3ZlcnNpb24iOiJWLjI5Iiwic3ViamVjdF9vcmdhbml6YXRpb24iOiJSZWdpb25lIExvbWJhcmRpYSIsInN1YmplY3Rfb3JnYW5pemF0aW9uX2lkIjoiMDMwIiwiYXVkIjoiaHR0cHM6Ly9tb2RpcGEtdmFsLmZzZS5zYWx1dGUuZ292Lml0L2dvdndheS9yZXN0L2luL0ZTRS9nYXRld2F5L3YxIiwicGF0aWVudF9jb25zZW50Ijp0cnVlLCJhY3Rpb25faWQiOiJDUkVBVEUiLCJyZXNvdXJjZV9obDdfdHlwZSI6IignMTE1MDItMl5eMi4xNi44NDAuMS4xMTM4ODMuNi4xJykiLCJzdWJqZWN0X2FwcGxpY2F0aW9uX2lkIjoiQVNUUkFJQSIsImV4cCI6MTcyMTI5NjU0Niwic3ViamVjdF9hcHBsaWNhdGlvbl92ZW5kb3IiOiJORVhVUy9BU1RSQUlBIiwiaWF0IjoxNzIxMjkyOTQ2LCJqdGkiOiIxNzE1MzI5ODMwIiwicGVyc29uX2lkIjoiVE5UVEtUNDdNMTFBNjM3Vl5eXiYyLjE2Ljg0MC4xLjExMzg4My4yLjkuNC4zLjImSVNPIn0.ByvjNdXIj1EW5R69-eRml_ncajWfD7or2bPDSWRVrVjOEGqNtgBBvvW2k2hV5LbQEx6nn9dvP-plii-nkgawXeo4exaMPAKhpw5SocQZjDYsrxVbATwNyxtNq7TE9ESurN2lIrvSM2wly3Fs8L-JhoU4v1guq9fD3qvNqjoegycg7q5PwxQieuK3iewcMWKE1tZ0p29zt3cIXdaCqlWmgHnmwm0I7ICr4oBlsWDnCG52sdd5AS_a24oC2wOFWrkJRHIF6w-76uGaFB9WNAKhGjVnif3O4XCpLwk9DjJG2q7l8NcKR6h2_mnUYo-260ZwfmXizIpZqdgLp6BJMuSYcQ' -H 'accept: application/json' -H 'Content-Type: multipart/form-data' -F 'requestBody={\"healthDataFormat\": \"CDA\", \"mode\": \"RESOURCE\", \"activity\": \"VERIFICA\"}' -F 'file=@C:/finalPDFA3.pdf;type=application/pdf'

Response: {"type":"https://govway.org/handling-errors/401/TokenAuthenticationFailed.html","title":"TokenAuthenticationFailed","status":401,"detail":"Invalid token","govway_id":"16e29713-44e6-11ef-a6bf-005056ae7395"}

data.json:

{
    "sub": "PGGMRZ70D01D969O^^^&2.16.840.1.113883.2.9.4.3.2&ISO",    
    "subject_role": "AAS",
    "purpose_of_use": "TREATMENT",
    "iss": "integrity:S1#111#TECHEMVSRLXX",
    "subject_application_id": "ASTRAIA",
    "subject_application_vendor": "NEXUS/ASTRAIA",
    "subject_application_version": "V.29",
    "locality": "925030925",
    "subject_organization_id": "030",
    "subject_organization": "Regione Lombardia",
    "aud": "https://modipa-val.fse.salute.gov.it/govway/rest/in/FSE/gateway/v1",
    "patient_consent": true,
    "action_id": "CREATE",
    "resource_hl7_type": "('11502-2^^2.16.840.1.113883.6.1')",
    "jti": "1715329830",
    "person_id":"TNTTKT47M11A637V^^^&2.16.840.1.113883.2.9.4.3.2&ISO",
    "pem_path": "C:/S1#111#TECHEMVSRLXX.pem",
    "p12_path": "C:/A1#111#TECHEMVSRLXX_.p12"
}

vigliottim commented 3 months ago

Buongiorno, i token da lei utilizzati non sono stati generati correttamente. Infatti, decodificandoli tramite il tool online jwt.io, compare il messaggio di errore "Invalid Signature":

Analizzando il data.json da lei riportato, sembrerebbe che non abbia generato correttamente il certificato p12 a partire da quello di firma e che stia utilizzando il certificato di autenticazione al suo posto:

Il certificato da utilizzare per la creazione del canale https è quello di autenticazione (A1XXXXXXXXX) mentre quello di firma (S1XXXXXXXXX) serve per firmare i token, come indicato nel seguente commento: https://github.com/ministero-salute/it-fse-support/issues/654#issuecomment-1985853383 Pertanto, nel data.json deve inserire il p12 generato a partire dal certificato di firma (S1XXXXXXXXX):

La rimandiamo al seguente screenshot con le istruzioni dettagliate per la costruzione del p12:

mvolpe-fvg commented 3 months ago

Risolto grazie.

ministero-salute / it-fse-support

Invalid token response - jwt-generator #928