Generating a JWT in Ruby
<p>I am trying to post to Ping Identity's PingID API and it keeps giving me 403 invalid signature.</p>

<p>I am fairly certain I am encoding the JSON messages correctly. I get the header string to be identical with their example data but I am not sure if I am creating the HMAC SHA256 signature correctly.</p>

<p>I'm using <a href="https://developer.pingidentity.com/en/api/pingid-api/example-pingid-user-registration.html" rel="nofollow">the API walkthrough</a> and the code I've written is:</p>

<pre><code>require 'json'
require 'base64'
require 'OpenSSL'
require 'rest-client'


use_base64_key = "JWC41crr322aUfdckVfJKHvGKNIPyAPGL7rMsTbzHlA="

jwtheader = {
    "alg": "HS256",
    "org_alias": "aaaaaaaa-a1b2-123a-b456-1234abcd5678",
    "token": "1a2b3c4d5e6f"
}

jwtpayload = {
    "reqHeader": {
        "locale": "en",
        "orgAlias": "aaaaaaaa-a1b2-123a-b456-1234abcd5678",
        "secretKey": "1a2b3c4d5e6f",
        "timestamp": "2015-09-03 11:57:25.229",
        "version": "4.6"
    },
    "reqBody": {
        "activateUser": false,
        "email": "marcher@pingdevelopers.com",
        "fName": "Meredith",
        "lname": "Archer",
        "username": "meredith",
        "role": "REGULAR",
        "clientData": nil
    }
}

jwtheader64 = Base64.urlsafe_encode64(jwtheader.to_json).chomp[0...-1]
jwtpayload64 = Base64.urlsafe_encode64(jwtpayload.to_json).chomp[0...-1]
signeddata = jwtheader64 + "." + jwtpayload64

digest = OpenSSL::Digest.new('sha256')
instance = OpenSSL::HMAC.digest(digest, use_base64_key, signeddata)
signature = Base64.urlsafe_encode64(instance).chomp[0...-1]
</code></pre>

<p>When I use this with my own information, it returns a 403 error. To get the timestamp in their format I'm using:</p>

<pre><code>timestamp = Time.now.utc.strftime("%m-%e-%y %H:%M:%S.000")
</code></pre>

<p>What am I doing incorrect?</p>

<p>Solution:</p>

<p>I was able to use this code to successfully construct the token:</p>

<pre><code>require 'json'
require 'base64'
require 'OpenSSL'
require 'rest-client'

pidalg = "HS256"
pidorg = "aaaaaaaa-a1b2-123a-b456-1234abcd5678"
pidtok = "c9fed74c5c994509b849ff65adb367d1"
timestamp = Time.now.utc.strftime("%Y-%m-%d %H:%M:%S.000")
uid = "meredith"
pidkey = "JWC41crr322aUfdckVfJKHvGKNIPyAPGL7rMsTbzHlA="

#jwt header
jwtheader = {
    "alg": pidalg,
    "org_alias": pidorg,
    "token": pidtok
}

#jwt payload
jwtpayload = {
    "reqHeader":{
        "locale":"en",
        "orgAlias":pidorg,
        "secretKey":pidtok,
        "timestamp":timestamp,
        "version":"4.6"
    },
    "reqBody":{
        "getSameDeviceUsers":false,
        "userName":uid,
    }
}

jwtheaderJSON = jwtheader.to_json
jwtheaderUTF = jwtheaderJSON.encode("UTF-8")
tokenheader = Base64.urlsafe_encode64(jwtheaderUTF)
puts tokenheader

jwtpayloadJSON = jwtpayload.to_json
jwtpayloadUTF = jwtpayloadJSON.encode("UTF-8")
tokenpayload = Base64.urlsafe_encode64(jwtpayloadUTF)
puts tokenpayload

signeddata = tokenheader + "." + tokenpayload

digest = OpenSSL::Digest.new('sha256')
bin_key = Base64.decode64(pidkey)
puts bin_key
instance = OpenSSL::HMAC.digest(digest, bin_key, signeddata)
signature = Base64.urlsafe_encode64(instance)
puts signature

apitoken = signeddata + "." + signature

puts apitoken
</code></pre>