trouble getting JWT for a server to server application in C - google-drive-api

Question

I have trouble getting a JWT for a server to server application.
With the following command
openssl pkcs12 -in mypkcs12-private.p12 -out privateKey.pem.
Following the doc /docs/OAuth2ServiceAccount,
I encoded my header
{"alg":"RS256","typ":"JWT"}
and my claim
{"iss":"******#developer.gserviceaccount.com","scope":"https://www.googleapis.com/auth/drive.file,"aud":"https://accounts.google.com/o/oauth2/token","exp":1401710837,"iat":1401707237}
in base64. so I created the base64 encoded signature using (b64header.b64claim), my private key and HMAC function. When I request the token using curl, I get an invalid_grant error. I tried many things but I don't know where the issue is.
here is the code
static size_t WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp)
{
size_t realsize = size * nmemb;
MemoryStruct *mem = (MemoryStruct *)userp;
mem->memory = realloc(mem->memory, mem->size + realsize + 1);
if(mem->memory == NULL) {
/* out of memory! */
printf("not enough memory (realloc returned NULL)\n");
return 0;
}
memcpy(&(mem->memory[mem->size]), contents, realsize);
mem->size += realsize;
mem->memory[mem->size] = 0;
return realsize;
}
char *base64encode(const char *normal, size_t length)
{
BIO *bmem, *b64;
BUF_MEM *bptr;
char *buff = NULL;
b64 = BIO_new(BIO_f_base64());
bmem = BIO_new(BIO_s_mem());
b64 = BIO_push(b64, bmem);
BIO_write(b64, normal, (int) length);
if (BIO_flush(b64) != 1) {
return NULL;
}
BIO_get_mem_ptr(b64, &bptr);
buff = (char *) malloc(bptr->length);
memcpy(buff, bptr->data, bptr->length-1);
buff[bptr->length - 1] = 0;
BIO_free_all(b64);
b64 = NULL;
return buff;
}
char * createClaimSet(char * address)
{
char * output = NULL;
char claim_format[] = "{\"iss\":\"%s\",\"scope\":\"https://www.googleapis.com/auth/drive.file\",\"aud\":\"https://accounts.google.com/o/oauth2/token\",\"exp\":%ld,\"iat\":%ld}";
size_t len_address = 0;
size_t size = 0;
time_t iat;
time_t exp;
time(&iat);
exp = iat + 3600;
if (address) len_address = strlen(address);
size = strlen(claim_format);
output = (char*) calloc(len_address + size - 8 + 20 + 1, sizeof(char));
sprintf(output,claim_format, address, exp, iat);
printf(output);
return output;
}
char *b64HmacSha256fct(char *line, char * keyp12, size_t size)
{
char *Hmac64 = "";
const EVP_MD *evp_md = EVP_sha256();
unsigned char md[EVP_MAX_MD_SIZE];
unsigned int md_len;
// HMAC
HMAC(evp_md, keyp12, (int)size, (const unsigned char*) line, strlen(line), md, &md_len);
Hmac64=base64encode(md, md_len);
return Hmac64;
}
int AuthServiceAccount(CURL *curl)
{
char * b64_claim_set = NULL;
char * claim_set = NULL;
char * header64 = NULL;
char * JWT = NULL;
char * toSign = NULL;
char * sig64 = NULL;
char * str = NULL;
char * data = NULL;
char * privateKey = NULL;
char grant[] = "grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer";
char uri[] = "https://accounts.google.com/o/oauth2/token";
char header[] = "{\"alg\":\"RS256\",\"typ\":\"JWT\"}";
char emailAddress[] = "xxxxxx#developer.gserviceaccount.com";
char PKCS12_FILE_PATH[] = "C:\\temp\\mykey.key";
FILE * pInputP12Name = NULL;
int i = 0;
int j = 0;
MemoryStruct writeMemory;
size_t fileP12size = 0;
size_t lclaim64 = 0;
size_t lclaimSet = 0;
size_t lheader64 = 0;
size_t lstr = 0;
size_t resultat;
header64 = base64encode(header, strlen(header));
if (header64) lheader64 = strlen(header64);
claim_set = createClaimSet(emailAddress);
if (claim_set) lclaimSet = strlen(claim_set);
b64_claim_set = base64encode(claim_set, lclaimSet);
if (b64_claim_set) lclaim64 = strlen(b64_claim_set);
str = (char*) calloc(lclaim64+1, sizeof(char));
if (!str) return 1;
for (i=0; i<lclaim64; i++) {
if (isprint(b64_claim_set[i])) {
str[j] = b64_claim_set[i];
j++;
}
}
str[j] = '\0';
if (str) lstr = strlen(str);
toSign = (char*) calloc(lheader64 + 1 + lstr + 1, sizeof(char));
if (!toSign) return 1;
sprintf(toSign,"%s.%s",header64,str);
pInputP12Name = fopen (PKCS12_FILE_PATH,"rb");
if (pInputP12Name==NULL) {
perror ("Error opening file");
return (-1);
}
else
{
resultat = _fseeki64(pInputP12Name, 0, SEEK_END);
fileP12size= (size_t) ftell(pInputP12Name);
rewind(pInputP12Name);
privateKey = (char *) calloc(fileP12size+1, sizeof(char));
resultat = fread (privateKey,sizeof(char),fileP12size,pInputP12Name);
fclose (pInputP12Name);
}
sig64 = b64HmacSha256fct(toSign,privateKey,fileP12size);
if (!sig64) return 1;
JWT = (char *) calloc(strlen(toSign) + 1 + strlen(sig64) + 1, sizeof(char));
sprintf(JWT,"%s.%s", toSign, sig64);
if (curl) {
FILE* pfile = NULL;
size_t size = 0;
memset(&writeMemory,'\0',sizeof(MemoryStruct));
size = strlen(grant)+strlen("&assertion=")+strlen(JWT);
data = (char *) calloc(size+1, sizeof(char));
if (!data) return 1;
sprintf(data,"%s&assertion=%s", grant, JWT);
curl_easy_reset(curl);
curl_easy_setopt( curl, CURLOPT_URL, uri );
curl_easy_setopt( curl, CURLOPT_PORT , 443 );
curl_easy_setopt( curl, CURLOPT_POST, 1 );
curl_easy_setopt( curl, CURLOPT_POSTFIELDS, data);
curl_easy_setopt( curl, CURLOPT_POSTFIELDSIZE, strlen(data));
curl_easy_setopt( curl, CURLOPT_HEADER, 1 );
curl_easy_setopt( curl, CURLOPT_VERBOSE, 1);
curl_easy_setopt( curl, CURLOPT_WRITEDATA, &writeMemory);
curl_easy_setopt( curl, CURLOPT_WRITEFUNCTION, WriteMemoryCallback);
curl_easy_setopt( curl, CURLOPT_SSL_VERIFYPEER, 0L);
curl_easy_setopt( curl, CURLOPT_SSL_VERIFYHOST, 0L);
curl_easy_perform(curl);
printf("%s",writeMemory.memory);
}
return 0;
}
int main(void)
{
CURL *curl;
curl_version_info_data *CurlVers;
CurlVers = curl_version_info( CURLVERSION_NOW );
curl_global_init(CURL_GLOBAL_ALL);
curl = curl_easy_init();
AuthServiceAccount(curl);
/* always cleanup */
curl_easy_cleanup(curl);
curl_global_cleanup();
exit(0);
}

Answer 1

The documentation states that you must use base64url encoding, which is a variant of base64 encoded that uses URL-safe characters.