title: Mobile First 7.1 FWLSE0376E: JWS signed ClientId signature does not match the client ID
body: <p>Intermittent issue occurs, While handshake between <strong>iOS Native</strong> Application to <strong>MobileFirst 7.1.0.00.20180425-1124</strong></p>
  
  <p><strong>Findings</strong></p>
  
  <ol>
  <li>Found out the "scope" query parameter is sent to the server as an empty string.</li>
  </ol>
  
  <p>Here i am trying to WWW-authenticate, based Custom authrealm.</p>
  
  <p><strong>Actual URL</strong></p>
  
  <pre><code>    http://localhost:8080/BA/authorization/v1/authorization?client_id=rr4a6042193a89c44a8d2415874ef6d279123456
   &amp;isAjaxRequest=true&amp;redirect_uri=http%3A%2F%2Fmfpredirecturi&amp;response_type=code&amp;scope=
  </code></pre>
  
  <p><strong>Excpected URL</strong></p>
  
  <pre><code>    http://localhost:8080/BA/authorization/v1/authorization?client_id=rr4a6042193a89c44a8d2415874ef6d279123456
  &amp;isAjaxRequest=true&amp;redirect_uri=http%3A%2F%2Fmfpredirecturi&amp;response_type=code&amp;scope=UserAuthRealm
  </code></pre>
  
  <ol start="2">
  <li>As per <strong>worklight-jee-library.jar</strong> --
  com.worklight.authorization.endpoint.token.<strong>TokenEndpoint</strong></li>
  </ol>
  
  <p>public key is <strong>not matched</strong>.</p>
  
  <pre><code>if (!Bytes.areEqual(clientPublicKey, jwsParts.getPublicKey().getEncoded())){
     logger.debug(method, "JWS signature does not match the client ID");
     return false;
   } 
  
   return true;
  </code></pre>
  
  <ol start="3">
  <li>So far issue occurred in <strong>iOS 12</strong> devices. not in other version of OS</li>
  </ol>
  
  <p>And please find configuration used..</p>
  
  <p><strong>application-descriptor.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8" standalone="no"?&gt;
      &lt;nativeIOSApp xmlns="http://www.worklight.com/native-ios-descriptor" applicationId="**App" bundleId="com.xxx.mobile" id="**App" platformVersion="7.1.0.00.20160528-1648" securityTest="CustomAppAuthenticityAutoProvTest" version="7.2"&gt;
  
      &lt;displayName&gt;iOS&lt;/displayName&gt;
      &lt;description&gt;iOS Mobile App&lt;/description&gt;
  
      &lt;accessTokenExpiration&gt;1800&lt;/accessTokenExpiration&gt;
      &lt;userIdentityRealms&gt;UserAuthRealm&lt;/userIdentityRealms&gt;
      &lt;pushSender password="*********"/&gt;
      &lt;licenseAppType&gt;APPLICATION&lt;/licenseAppType&gt;
      &lt;targetCategory&gt;B2C&lt;/targetCategory&gt;
  &lt;/nativeIOSApp&gt;
  </code></pre>
  
  <p><strong>conf/authenticationConfig.xml</strong></p>
  
  <pre><code>&lt;realm name="UserAuthRealm" loginModule="CustomAuthLoginModule"&gt;
     &lt;className&gt;com.ibm.mfp.CustomUserAuthenticator&lt;/className&gt;
  &lt;/realm&gt;
  </code></pre>
  
  <p><strong>worklight.properties</strong></p>
  
  <pre><code>mfp.session.independent=true
  mfp.attrStore.type=database
  </code></pre>
  
  <p><strong>Device Details</strong></p>
  
  <pre><code> {
      "x-wl-clientlog-env":"iOSnative",
      "x-wl-clientlog-appversion":"7.0","
      "x-wl-clientlog-model":"iPhone8,2",
      "x-wl-clientlog-osversion":"12.0",
      "x-wl-clientlog-appname":"iOSWLApp"
    } 
  </code></pre>
  
  <p><strong>Response</strong></p>
  
  <pre><code>{
     "error_description":"Client authentication failed",
     "error":"invalid_client"
  }
  </code></pre>
  
  <p><strong>Message.log</strong></p>
  
  <p>00002171 com.worklight.core.auth.impl.AuthorizationFilterUtils<br>
  <strong>E FWLSE0376E: JWS signed ClientId signature does not match the client ID</strong></p>
  
  <p>0000285b com.worklight.oauth.validation.Validator<br>
  I OAuthTAI Authentication failed with Status = 401, WWW-Authenticate: Bearer realm="imfAuthentication", <strong>scope=""</strong></p>
  
  <p><strong>Trace.log</strong></p>
  
  <p>[1/27/19 19:08:25:434 GST] 0000285b id=         com.worklight.oauth.validation.Validator                     > validate ENTRY</p>
  
  <p>[1/27/19 19:08:25:434 GST] 0000285b id=         com.worklight.oauth.validation.Validator                     1 validate missing_authorization</p>
  
  <p>[1/27/19 19:08:25:434 GST] 0000285b id=         <strong>com.worklight.oauth.validation.Validator                     I processErrorCode OAuthTAI Authentication failed with Status = 401, WWW-Authenticate: Bearer realm="imfAuthentication", scope=""</strong></p>
  
  <p>[1/27/19 19:08:25:434 GST] 0000285b id=         com.worklight.adapters.rest.WLShouldCompressPredicat         1 shouldCompress Request: <a href="http://localhost:8080/MA/adapters/AccessAdapter/getDetails" rel="nofollow noreferrer">http://localhost:8080/MA/adapters/AccessAdapter/getDetails</a> disableCompressionAttr=null
  [1/27/19 19:08:25:434 GST] 0000285b id=         com.worklight.adapters.rest.WLShouldCompressPredicat         1 shouldCompress Request: <a href="http://localhost:8080/MA/adapters/AccessAdapter/getDetails" rel="nofollow noreferrer">http://localhost:8080/MA/adapters/AccessAdapter/getDetails</a> acceptGZipEncoding=true</p>
  
  <p>[1/27/19 19:08:25:435 GST] 0000285b id=         com.worklight.common.util.BaseProjectLocal                   1 unset unset ProjectLocal</p>
  
  <p>[1/27/19 19:08:25:435 GST] 0000285b id=         com.worklight.common.util.BaseProjectLocal                   3 unset <strong>java.lang.Throwable
          at com.worklight.common.util.BaseProjectLocal.unset(BaseProjectLocal.java:114)</strong>
          at com.worklight.core.auth.impl.MFPRequestListener.requestDestroyed(MFPRequestListener.java:24)
          at com.ibm.ws.webcontainer.webapp.WebApp.notifyServletRequestDestroyed(WebApp.java:2747)</p>