I am trying to authenticate via CIS2 and I am getting the following response from our token request.
({“error_description”:“Unable to create RSA Public Key”,“error”:“server_error”})
(With a 500 code)
This is this step in the sign in journey: https://digital.nhs.uk/services/care-identity-service/applications-and-services/cis2-authentication/integrate/design-and-build/sign-in-journey#token-request
We successfully managed the authentication request: https://digital.nhs.uk/services/care-identity-service/applications-and-services/cis2-authentication/integrate/design-and-build/sign-in-journey#authentication-request
For context, we were previously able to connect successfully - we have progressed our CIS2 authentication to the status of getting a certificate of conformance. However we have been unable to put resources into progressing further for a while - the last time I can see we successfully logged in was probably around a year ago.
Our code has not changed in the interim - we are sending the same content (using the “Private key JWT” method).
I created new keys and put them on our JWKs endpoint in case there was an issue with stale keys.
Does anyone have any ideas why we are getting this 500 error and how we can correct it?
Please can you provide the client ID and environment you are using and I can check the config. The error indicates that we cannot build the key from the JWKS file - which implies the JSON content is invalid.
Ensure that the JWKS file can be read, the content is correct - you can you a tool like https://jwt.io to check the token against your public key
Our client ID is 245954706564.apps.supplier
The environment is integration (we use this endpoint to request the access token: “https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/access_token”)
I have used https://jtw.io to check the JWT we have sent, and it verifies it as correct, and when I feed it the public key from our JWKS file it validates the signature successfully.
I have then also used https://jsonlint.com/ to check our JWKs is valid - it says it is.
If it is helpful I can provide the JWKs file, and indeed an example JWT.
Thank you very much for replying John, much appreciated!
For those following after:
After some back and forth, it appears the issue was in our JWKS file - there were some legacy keys in there that were not in a format that the parser on the NHS England end was unable to read, leading to this issue. Removing those keys from the file got us connected.
Many thanks to John for the help!