DocuSign Spoke Configuration Question

[robinson_gregor]

Hi,

I am trying to do a POC for the DocuSign integration and am having some difficulties with OAuth I was hoping someone could help me out with.

I am following this: https://docs.servicenow.com/bundle/newyork-servicenow-platform/page/administer/integrationhub-store-...

I have followed the instructions to a T, and am getting an invalid_grant error when trying to get the token from DocuSign. I am pretty sure my issue is with the Java Key Store certificate part of the configuration. Is this Key Store something that DocuSign provides that I may be missing or is this something I will have to manually create with the public/private RSA keys DocuSign provides?

Any help would be greatly appreciated!

[Sandeep150]

Hi,

Please refer the below link to create Java Key Store (JKS), and follow the steps as mentioned in ServiceNow documentation.
http://www.agentbob.info/agentbob/79-AB.html

Thanks.

[nstarr]

I've had the same experience as you. I also expect it's the JKS certificate that is the issue but an unsure how it is supposed to be generated / retrieved. Did you manage to get it working?

[nstarr]

I received this response on how to set up the DocuSign spoke from a HI ticket I raised. It explains how to generate the jks file and helped me progress.

Pre-Requisite:

1. Should have DocuSign Account
2. ServiceNow Instance with DocuSign Spoke Installed

Part 1:

Create an app in your DocuSign Account

1. Login to your DocuSign Account
2. Navigate to the Admin section & Click on API and Keys
3. Click on ADD APP / INTEGRATION KEY button to create an Integration app
4. Get hold of Integration Key & Secret Key
5. Click on Add RSA Keypair & copy the Public, Private & Keypair ID into safer location
6. Enter the value for Redirect URLs (e. g - https://yourinstancename.service-now.com/oauth_redirect.do)

Note: Make sure You select User Application as “Authorization Code Grant”

Part 2:

Generate the JKS File

1. Copy the Private key that was generated from your DocuSign Integration app and make a new file key with this private key.
2. Create CA signed certificate using private key, please run the below command for this

openssl req -new -x509 -key privatekey.key -out cacert.pem -days 1095

3. Create PKCS 12 file using your private key and CA signed certificate, please run the below command for this (Set the Password, whenver it asks)

openssl pkcs12 -export -in cacert.pem -inkey privatekey.key -certfile cacert.pem -out testkeystore.p12

4. Now, Create the JKS file by running the below command

keytool -importkeystore -srckeystore testkeystore.p12 -srcstoretype pkcs12 -destkeystore ranDocusign.jks -deststoretype JKS

Part 3:

3. Create the oAuth Profile & JWT Provider in your ServiceNow Instance
4. Login to your ServiceNow instance
5. Navigate to the System Definition -> Certificates & Click on New to create a New Certificate
6. Select the Type to Java Key Store & Enter the password which created while Generating JKS file & Attach the JKS file
7. Click on Validate Stores/Certificates link
8. Navigate to the System oAuth -> JWT Keys & create a new JWS Key
9. Select the Previously created Cert for Signing Keystore & Enter the Signing Key
10. Navigate to the JWT Providers -> Create new JWT Provider
11. Select the Previously created JWT Key for Signing Configuration enter the appropriate values for Standard Claims & Create a new entry in Custom Claims & provide the value for scope. Please access below link for more info

https://developers.docusign.com/esign-rest-api/guides/authentication/oauth2-jsonwebtoken#step-2-crea...

9. Navigate to the System oAuth ->Application registries & create a new oAuth Profile
10. Enter the ClientID & Client Secret which you have got from DocuSign Integrator app
11. Provide the Auth URL as follows https://account-d.docusign.com/oauth/auth
12. Provide the Token URL as followshttps://account-d.docusign.com/oauth/token
13. Select the Default Grant Type as JWT Bearer
14. Now, Save the record
15. Create the oAuth Entity Scope (Add your necessary scopes here)

Part 3:

4.1 Obtaining Consent as Individual

1. Navigate to the System oAuth ->Application registries -> DocuSign oAuth & Create a new oAuth entity profile with Grant Type as Authorization Code under the oAuth entity profile related list
2. Add the necessary scopes for this oAuth Profile as well.
3. Navigate to the Connection & Credentials -> Credentials & Create new Credentials of type oAuth 2.0
4. Select the oAuth Entity Profile created with Grant type as Authorization Code
5. Now, Click on Get OAuth Token Link & enter your DocuSign Username & Password to provide the consent
6. Now, Again Create a new credentials of type oAuth 2.0 & select the entity profile of type JWT Bearer
7. Click on Get OAuth Link & You can see that oAuth Flow is completed successfully message.

4.2 Obtaining Consent as Organization Admin

1. In case of Obtaining Organization Admin Consent for an application owned by your organization, please see the below link

https://developers.docusign.com/esign-rest-api/guides/authentication/obtaining-consent#admin-consent...

[shanedavis]

@nstarr   Good morning!  I have a couple questions if you don't mind answering.  I've been through all of the steps above.  We can validate the JKS cert (Part 3 #7), we can get the Authorization, we get the token from the Authorization Code (Part 4#5), we get the token from JWT Bearer (Part 4 #7) and we have DocuSign all set up.  We've even completed the part for the webhook.  Our issue is that when we run the Get Accounts flow, we get the error below.

The instructions at the link below add a part 6 to what you put here.  It says to create another credential, but I already have an Auth Code & JWT so do I really need a 3rd credentials or just the 2 I have?

How to Set up DocuSign spoke - Support and Troubleshooting (servicenow.com)

Our goal is to have the webhook for pulling all DocuSign accounts, etc into ServiceNow AND also to use the spoke for areas like onboarding for associates to sign documents.

{
    "Action Status": {
        "code": 1,
        "message": "Error:  <,Detail: Unexpected token: <"
    }
}