JSON Web Token rejected with error message

Products

• SITEMINDER
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Agents (SiteMinder)

Issue/Introduction

A JSON Web Token Authentication Scheme has been configured and assigned to a realm.  Users are unable to authenticate using this scheme, however.  The following is seen in the Policy Server trace log when the problem occurs:

[10/30/2025][16:14:27.793][16:14:27][58613][140598497502976][SmAuthUser.cpp:878][ServerTrace][][][][][][][][][][][][][][][][][][][][ IJwtTokenParser.JWTState. Validating with secret.][SmJWTAuthScheme:: IJwtTokenParser.JWTState. Validating with secret.][][][][][][][][][][][][][][][][][][][]
[10/30/2025][16:14:27.794][16:14:27][58613][140598497502976][SmAuthUser.cpp:878][ServerTrace][][][][][][][][][][][][][][][][][][][][ JWT HMAC verification with status as true][SmJWTAuthScheme:: JWT HMAC verification with status as true][][][][][][][][][][][][][][][][][][][]
[10/30/2025][16:14:27.794][16:14:27][58613][140598497502976][SmAuthUser.cpp:878][ServerTrace][][][][][][][][][][][][][][][][][][][][ Expected state of JWT Token for validation:BOTH,but received state is:SIGNONLY][SmJWTAuthScheme:: Expected state of JWT Token for validation:BOTH,but received state is:SIGNONLY][][][][][][][][][][][][][][][][][][][]

Environment

All Supported Policy Servers

Cause

Whenever the JWT Authentication Attribute for Encryption Validation section of the JSON Web Token Authentication Scheme properties is populated with values, the incoming JWT must be encrypted.  

Resolution

To allow an unencrypted JWT, clear all fields in the JWT Authentication Attribute for Encryption Validation section of the JSON Web Token Authentication Scheme properties.