Re: oAuth2 Invalid Access Token length

Hi Brian,

you're right. Currently we only support SAML Bearer Assertions as exchange token in order to get an OAuth 2.0 access token. We also support the an authorization grant as exchange token. However this is for scenarios where you explicitely want the user to decide which resources he/she likes to expose (like in Social platforms).

I suppose you get the JWT token from some sort of Identity Provider (IDP), do you? Isn't this IDP capable of issuing SAML Bearer assertions?

If so here's a WIKI with detailed information on how to get this working with SAP NW Gateway: http://wiki.scn.sap.com/wiki/display/Security/Using+OAuth+2.0+from+a+Web+Application+with+SAML+Bearer+Assertion+Flow

Regards,

Mathias