{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40892,"path":"platform-security/connections-and-credentials/docusign-example.md","title":"Configure a template for OAuth JWT Bearer grant type","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure a template for OAuth JWT Bearer grant type\n\nThis example configuration template sets up Credential and Connection records using the JWT Bearer grant type to authenticate requests to Docusign.\n\n## Default data template\n\nEach top-level item in the default data template creates an associated record. The template includes these sections:\n\n-   `Credential`: Creates a record in the Credentials table.\n-   `Connection`: Creates a record in the Connections \\[sys\\_connection\\] table and any associated connection records.\n-   `Additional`: Optionally creates records in a custom table. The post processing script tells the system what to do with these records.\n\nThe following example creates the records required for OAuth JWT Bearer grant type authentication.\n\n```\n{\n  \"credential\": {\n    \"oauth_entity\": {\n      \"oauth_entity_profile\": [\n        {\n          \"grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n          \"name\": \"Docusign Profile\",\n          \"default\": true,\n          \"oauth_entity_profile_scope\": [\n            \"users:read.email\"\n          ]\n        }\n      ],\n      \"code_challenge_method\": \"S256\",\n      \"type\": \"consumer\",\n      \"oauth_entity_scope\": [\n        {\n          \"oauth_entity_scope\": \"users:read.email\",\n          \"name\": \"email\"\n        }\n      ],\n      \"client_id\": \"<provider-client-id>\",\n      \"use_mutual_auth\": false,\n      \"revoke_token_url\": \"https://<provider-domain-name>.com/oauth2/revoke\",\n      \"default_grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n      \"public_client\": false,\n      \"oauth_api_script\": \"3e3a3a11c333210016194ffe5bba8f70\",\n      \"name\": \"Docusign Spoke OAuth\",\n      \"client_secret\": \"<provider-client-secret>\",\n      \"auth_url\": \"https://<provider-domain-name>.com/oauth2/auth\",\n      \"token_url\": \"https://<provider-domain-name>.com/oauth2/token\",\n      \"redirect_url\": \"https://<instance-name>.service-now.com/oauth_redirect.do\"\n    },\n    \"jwt_provider\": {\n      \"jwt_keystore_aliases\": {\n        \"kid\": \"<provider-key-id>\",\n        \"name\": \"Docusign Spoke JWT Key\",\n        \"signing_keystore\": \"<signing-keystore-sys-id>\",\n        \"signing_algorithm\": \"rsa_256\",\n        \"signing_key_password\": \"password\"\n      },\n      \"jwt_claim_validation\" : [ {\n        \"name\" : \"iss\",\n        \"is_standard\" : true,\n        \"data_type\" : \"string\",\n        \"value\":\"<docusign-iss-claim>\"\n      }, {\n        \"name\" : \"sub\",\n        \"is_standard\" : true,\n        \"data_type\" : \"string\",\n        \"value\":\"<docusign-sub-claim>\"\n      }, {\n        \"name\" : \"aud\",\n        \"is_standard\" : true,\n        \"data_type\" : \"string\",\n        \"value\":\"<docusign-aud-claim>\"\n      }, {\n        \"name\" : \"scope\",\n        \"is_standard\" : false,\n        \"data_type\" : \"string\",\n        \"value\" : \"signature impersonation\"\n      } ],\n      \"name\": \"Docusign Spoke JWT Provider\",\n      \"jwt_api_script\": \"9ef6af86ff10330001d3cd6bd53bf144\"\n    },\n    \"name\": \"Docusign Spoke Credential\",\n    \"table\": \"oauth_2_0_credentials\"\n  },\n  \"connection\": {\n    \"use_mid\": false,\n    \"connection_url\": \"https://<provider-domain-name>.com\",\n    \"name\": \"Docusign Spoke Connection\",\n    \"table\": \"http_connection\"\n  },\n\"additional\":{\n    \"docusign_account_name\": \"<docusign-account-name>\",\n    \"docusign_account_email\": \"<docusign-account-email>\"\n}\n}\n```\n\n## Dynamic data schema\n\nThe dynamic data schema defines what the user sees when they create a Connection &amp; Credential alias and collects their input. Use dot-walking syntax to map user input to fields created in the default data template. For example, `connection_fields` maps user input to the `connection_url` field in the `connection` object created by the default data template.\n\n```\n{\n  \"connection_fields\": [\n    {\n      \"name\": \"connection.connection_url\",\n      \"label\": \"Connection URL\",\n      \"type\": \"text\",\n      \"defaultValue\": \"https://demo.docusign.net\",\n      \"hint\": \"Connection URL for Docusign\"\n    }],\n\"additional_fields\":[\n    {\n      \"name\": \"additional.docusign_account_id\",\n      \"label\": \"Docusign Account Number\",\n      \"type\": \"text\",\n      \"hint\": \"Docusign Account Number\"\n    },\n    {\n      \"name\": \"additional.docusign_account_name\",\n      \"label\": \"Docusign Account Name\",\n      \"type\": \"text\",\n      \"hint\": \"Name to identify the Docusign account\"\n    },\n    {\n      \"name\": \"additional.docusign_account_email\",\n      \"label\": \"Docusign Account Email\",\n      \"type\": \"text\",\n      \"hint\": \"Docusign Account Email\"\n    }\n  ],\n  \"credential_fields\": [\n    {\n      \"name\": \"credential.oauth_entity.client_id\",\n      \"label\": \"OAuth Client ID\",\n      \"type\": \"text\",\n      \"hint\": \"Client ID for Docusign\"\n    },\n    {\n      \"name\": \"credential.oauth_entity.redirect_url\",\n      \"label\": \"OAuth Redirect URL\",\n      \"type\": \"text\",\n      \"defaultValue\": \"https://<instance-name>.service-now.com/oauth_redirect.do\",\n      \"hint\": \"Callback URL for Docusign\"\n    },\n {\n      \"name\": \"credential.jwt_provider.jwt_claim_validation[0].value\",\n      \"label\": \"Issuer (iss) Claim value\",\n      \"type\": \"text\",\n      \"hint\": \"The integrator key (also known as client ID) of the application\"\n    },\n {\n      \"name\": \"credential.jwt_provider.jwt_claim_validation[1].value\",\n      \"label\": \"Subject (sub) Claim value\",\n      \"type\": \"text\",\n      \"hint\": \"The user ID of the user to be impersonated\"\n    },\n {\n      \"name\": \"credential.jwt_provider.jwt_claim_validation[2].value\",\n      \"label\": \"Audience (aud) Claim value\",\n      \"type\": \"text\",\n      \"defaultValue\": \"account-d.docusign.com\",\n      \"hint\": \"The URI of the authentication service instance to be used e.g. account.docusign.com\"\n    },\n    {\n      \"name\": \"credential.jwt_provider.jwt_keystore_aliases.kid\",\n      \"label\": \"Key ID (kid)\",\n      \"type\": \"text\",\n      \"hint\": \"Indicates which key was used to secure the JWS\"\n    },\n    {\n      \"name\": \"credential.jwt_provider.jwt_keystore_aliases.signing_keystore\",\n      \"label\": \"Key Store\",\n      \"type\": \"file\"\n    }\n  ]\n}\n```\n\n## Post processing script\n\nThe following post processing script maps user input to fields in the sn\\_docusign\\_spoke\\_accounts table.\n\n```\n(function execute(aliasId, connectionSysId, jsonDefaultData, jsonDynamicData) {\n\tvar jsonDynamicDataP = JSON.parse(jsonDynamicData);\n\tvar accountGR = new GlideRecord(\"sn_docusign_spoke_accounts\");\n    accountGR.setValue(\"account_name\", jsonDynamicDataP[\"additional.docusign_account_name\"]);\n    accountGR.setValue(\"alias\", aliasId);\n    accountGR.setValue(\"email\", jsonDynamicDataP[\"additional.docusign_account_email\"]);\n    accountGR.setValue(\"id\", jsonDynamicDataP[\"additional.docusign_account_id\"]);\n    accountGR.insert();\n})(aliasId, connectionSysId, jsonDefaultData, jsonDynamicData);\n```\n\n## Resulting Docusign Connection and Credential configuration form\n\nWhen the user navigates to the associated Docusign Connection &amp; Credential Alias and selects **Create New Connection &amp; Credential**, the following dialog appears.\n\n\\[Omitted image \"docusign-template.png\"\\] Alt text: Docusign form requiring user input.\n\n**Parent Topic:**[Connection &amp; Credential configuration templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/connections-and-credentials/spoke-configuration-template.md)\n\n"}}