使用OAuth应用令牌调用DocuSign API时触发Consent Required错误

问题场景 #

尝试使用以下Python代码生成DocuSign OAuth令牌：

def get_token():

    DS_JWT = {
        "ds_client_id": "79b1adb9-xxxx-xxxx-xxxx-4450dd98a712",
        "ds_impersonated_user_id": "3300d1d8-xxxx-xxxx-xxxx-552b87311b0f",
        "private_key_file": "private.key",
        "authorization_server": "account-d.docusign.com"
    }

    private_key = get_private_key(DS_JWT["private_key_file"]).encode("ascii").decode("utf-8")
    api_client = ApiClient()
    ds_app = api_client.request_jwt_user_token(
        client_id=DS_JWT["ds_client_id"],
        user_id=DS_JWT["ds_impersonated_user_id"],
        oauth_host_name=DS_JWT["authorization_server"],
        private_key_bytes=private_key,
        expires_in=3600,
        scopes=["signature", "impersonation"]
    )

    return ds_app.access_token

调用时触发400 Bad Request错误，响应体明确提示{"error":"consent_required"}，完整错误栈如下：

File "src/docusign_template_app/obtain_token_4.py", line 38, in <module>
    main()
  File "src/docusign_template_app/obtain_token_4.py", line 33, in main
    token_4 = get_token_4()
  File "src/docusign_template_app/obtain_token_4.py", line 18, in get_token_4
    ds_app = api_client.request_jwt_user_token(
  File "/home/lluis/.pyenv/versions/docusign-template-app_py38/lib/python3.8/site-packages/docusign_esign/client/api_client.py", line 691, in request_jwt_user_token
    response = self.request("POST", "https://" + oauth_host_name + "/oauth/token",
  File "/home/lluis/.pyenv/versions/docusign-template-app_py38/lib/python3.8/site-packages/docusign_esign/client/api_client.py", line 393, in request
    return self.rest_client.POST(url,
  File "/home/lluis/.pyenv/versions/docusign-template-app_py38/lib/python3.8/site-packages/docusign_esign/client/api_response.py", line 246, in POST
    return self.request("POST", url,
  File "/home/lluis/.pyenv/versions/docusign-template-app_py38/lib/python3.8/site-packages/docusign_esign/client/api_response.py", line 208, in request
    raise ApiException(http_resp=r)
docusign_esign.client.api_exception.ApiException: (400)
Reason: Bad Request
Trace-Token: eadcd891-a820-414c-a86e-3a51f318361c
Timestamp: Tue, 30 Aug 2022 09:17:05 GMT
HTTP response headers: HTTPHeaderDict({'cache-control': 'no-cache, no-store, must-revalidate', 'pragma': 'no-cache', 'content-type': 'application/json; charset=utf-8', 'expires': '-1', 'x-docusign-tracetoken': 'eadcd891-a820-414c-a8
6e-3a51f318361c', 'x-frame-options': 'SAMEORIGIN', 'x-xss-protection': '1; mode=block; report=/client-errors/xss', 'x-docusign-node': 'DA1DFE179', 'strict-transport-security': 'max-age=31536000; includeSubDomains; preload', 'referrer-policy': 'no-referrer,strict-origin-when-cross-origin', 'x-content-type-options': 'nosniff', 'date': 'Tue, 30 Aug 2022 09:17:05 GMT', 'content-length': '28'})
HTTP response body: b'{"error":"consent_required"}'

原因分析 #

consent_required错误表示被 impersonate 的用户尚未向你的DocuSign应用授予请求的权限，JWT模式要求用户先完成一次授权操作，之后才能通过JWT直接获取令牌。

解决步骤 #

1. 构造授权URL
   替换以下参数生成授权链接：

   https://account-d.docusign.com/oauth/auth?response_type=code&scope=signature+impersonation&client_id=79b1adb9-xxxx-xxxx-xxxx-4450dd98a712&redirect_uri=你的重定向URL
   

   注意：redirect_uri必须是你在DocuSign开发者后台为该应用配置的重定向地址，哪怕是本地测试地址（比如http://localhost:8080）也可以。

2. 完成用户授权
   使用代码中ds_impersonated_user_id对应的用户账号登录DocuSign，打开上面构造的URL，按照页面提示确认授权你的应用访问指定权限。

3. 重新运行代码
   授权完成后，再次执行你的JWT令牌生成代码，即可正常获取OAuth令牌。

补充说明 #

• 生产环境中，用户只需要完成一次授权，后续JWT请求无需重复授权；
• 测试环境（account-d.docusign.com）的授权有效期为30天，到期后需要重新执行授权步骤。

内容的提问来源于stack exchange，提问作者Lous