Clash Royale CLAN TAG

DocuSign Service Integration Authentication using Organization Admin to grant consent on the app and impersonate everyone

I have been successfully using Service Integration Authentication to create an envelope. Here are the steps I have made to authenticate the user.

Granting consent individually for Organization Admin A by redirecting them to this URL:

https://account-d.docusign.com/oauth/auth?
response_type=code&scope=signature%20impersonation&client_id=7c2b8d7e-83c3-4940-af5e-cda8a50dd73f&redirect_uri=https://client.example.com/callback

https://account-d.docusign.com/oauth/auth?
response_type=code&scope=signature%20impersonation&client_id=7c2b8d7e-83c3-4940-af5e-cda8a50dd73f&redirect_uri=https://client.example.com/callback

After Organization Admin A clicked "Accept" the consent is granted

Create the JWT using code provided in the SDK, here's the information I have provided in the JWT:

{
"iss": {integrator key},
"sub": <user ID of Organization Admin A>,
"iat": <timestamp when issued>,
"exp": <expiration date>,
"aud": "account-d.docusign.com",
"scope": "signature impersonation"
}

{
"iss": {integrator key},
"sub": <user ID of Organization Admin A>,
"iat": <timestamp when issued>,
"exp": <expiration date>,
"aud": "account-d.docusign.com",
"scope": "signature impersonation"
}

Using this generated Jwt I made a POST request to https://account-d.docusign.com/oauth/token?grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion={JWT} to exchange for an Access Token

POST

https://account-d.docusign.com/oauth/token?grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion={JWT}

Use that generated access token I have successfully created an envelope

So at this stage I have confirmed that I have generated the JWT correctly, created Integrator Key correctly, I have also provided the right information in the create JWT request.

Then I realized from my application it would be ideal if I don't have to do step 1 above all the time. I would like to grant consent without the UI (redirect URL) and be able to impersonate everyone in the organization. So here's what I did:

From here I created the JWT, the only information changed in the payload now is the userId pointing to Organization Admin B:

{
"iss": {integrator key},
"sub": <user ID of Organization Admin B>,
"iat": <timestamp when issued>,
"exp": <expiration date>,
"aud": "account-d.docusign.com",
"scope": "signature impersonation"
}

{
"iss": {integrator key},
"sub": <user ID of Organization Admin B>,
"iat": <timestamp when issued>,
"exp": <expiration date>,
"aud": "account-d.docusign.com",
"scope": "signature impersonation"
}

JWT generated I went ahead to make a POST request to https://account-d.docusign.com/oauth/token?grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion={JWT} to exchange for an Access Token and here's what I got:

POST

https://account-d.docusign.com/oauth/token?grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion={JWT}

{
"error": "consent_required"
}

{
"error": "consent_required"
}

If I have already "Authorize Application", how could consent be required?

I have also tried omitting the userId in the JWT request because according to this blog post

The user id of the principal you are requesting a token for. If
omitted a token will be issued to represent the application itself
instead of a user in the system.

and that essentially what I want. But when I got the JWT generated and attempted to an Access Token, I will then get "either username or password" is not corrected.

This is so confusing as there isn't an article showing step by step on how to use the Organization Admin Tool to grant consent on the app and impersonate everyone. Most of the articles only address individual granting consent. Could someone please help me with this?

Thanks.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.