authenticate using OAuth + SAML bearer flow (invalid assertion) - single-sign-on

Question

I am trying to authenticate using OAuth + SAML bearer flow (http://help.salesforce.com/help/doc/en/remoteaccess_oauth_SAML_bearer_flow.htm)
But i am stuck at the point where i am getting invalid assertion error:
{"error":"invalid_grant","error_description":"invalid assertion"}
Here's my assertion:
<?xml version="1.0"?>
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="C625490D-C2B9-15BE-6DFA-7286288D9655" IssueInstant="2012-04-04T06:54:14Z" Version="2.0">
<saml:Issuer>3MVG9Y6d_Btp4.....d0jnN</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#C625490D-C2B9-15BE-6DFA-7286288D9655">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>f187DeCiwFhhH2etlU+5byskey4=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
MIID6zCCAtOgAwI...........4qbvd3sxAQmkhR98FSsQixMI+bTHq9zRgeFu6W5GWsun3tmqNE=
</ds:SignatureValue>
</ds:Signature>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">org2#dot.com
</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData Recipient="https://login.salesforce.com/services/oauth2/token" NotOnOrAfter="2012-11-20T06:35:42Z"/>
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2012-11-19T06:34:42Z" NotOnOrAfter="2012-11-20T06:35:42Z">
<saml:AudienceRestriction>
<saml:Audience>https://login.salesforce.com/services/oauth2/token</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2012-11-20T06:35:42Z" SessionIndex="ED868FE5-841D-5192-766C-941A60D6602F">
<saml:AuthnContext>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
</saml:Assertion>
And here's how i am making the request:
curl https://login.salesforce.com/services/oauth2/token -H "Content-Type='application/x-www-form-urlencoded'" -d "grant_type=urn:ietf:params:oauth:grant-type:saml2-bearer" -d "assertion=`cat saml-assertion.base64`"
I have properly encoded the assertion to base64url (previously i was getting error regarding invalid chars in assertion, which i fixed)
Please advice me what/where I can check further on this to know why my assertion is invalid!
PS: Everything is copied from above url's sample assertion, and username,issuer and certificate are changed by me. Also I am setting the NotBefore as the exact login time of the user.

Answer 1

Grant type value needs to be encoded as well, when you are sending that.
urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer
Saml assertion needs to be single assertion. It needs to be Base64 encoded as you did and then remove padding or urlencode again.
The value of the "assertion" parameter MUST contain a single SAML 2.0
Assertion. The SAML Assertion XML data MUST be encoded using
base64url, where the encoding adheres to the definition in Section 5
of RFC 4648 [RFC4648] and where the padding bits are set to zero. To
avoid the need for subsequent encoding steps (by "application/
x-www-form-urlencoded" [W3C.REC-html401-19991224], for example), the
base64url encoded data SHOULD NOT be line wrapped and pad characters
("=") SHOULD NOT be included.
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-saml2-bearer-17#section-2.1
Send with post encoded values:
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer&
assertion=PHNhbWxwOl...[omitted]...ZT4