I currently get the error "Invalid JWT token. Could not resolve issuer token" (401 error) when trying to start a new SP2013 Workflow instance.

I deleted the WF farm already and recreated it (and re-registered with SP). I can create and publish workflows with SharePoint designer. When starting a new instance it starts, but then fails. In Fiddler I can see a lot of 401 errors with said error message. When browsing to localhost:12291 I get a 403 - when executing the browser as Administrator, I can access the XML served by the workflow service. User Profile Service is running, and synching with no problems. I ran multiple full synchs already.

I can't find any error message in the event log, none in the ULS log. The debug table just states the obvious: "Attempt 2 of the HTTP request to 'http://sp.dev/sites/test/_vti_bin/client.svc/web/lists/getbyid(guid'2f523828-6687-43f1-a5b7-af144fea8739')' will be made in 00:00:06." - all 401 errors.

How do I reset my system? how do I do further testing?


I have just had the same issue in my environment. In my case I have HTTP enabled on the workflow farm. During re-install the workflow farms HTTP endpoint disappeared (you can run the Get-WFFarm PowerShell command and check the Endpoints there).

So the solution in my case was to properly configure the HTTPS endpoint and than re-register the workflow farm with SharePoint. The snippet below assumes that you have exported the SSL certificate from the workflow manager IIS web site to c:\wfm.cer.

$cert = Get-PfxCertificate "c:\wfm.cer" 
New-SPTrustedRootAuthority -Name "Workflow Manager Farm" -Certificate $cert
Register-SPWorkflowService -SPSite "http://dev.sharepoint.com" -WorkflowHostUri "https://devmachine.devdomain.local:12290" -Force

I order to get debugging for this issue configured in the ULS log you can modify the Diagnostic logging settings in Central Administration. Set the following in SharePoint Foundation category to Verbose: App Auth, Application Authentication, Authentication Authorization, Claims Authentication, CSOM.

| improve this answer | |
  • Can't recreate this problem anymore, as I reset the whole system. But your approach seems reasonable, one should always use HTTPS for WF (I used HTTP). Also it's good you mentioned which logs should be set to verbose! – Dennis G Aug 30 '13 at 19:05
  • Thanks for your feedback. I thought that you would have solved the issue otherwise in the meantime. But it is good to hear that you have had the same setup (HTTP enabled), so it's probably a pretty common issue. – Bernd Rickenberg Aug 31 '13 at 17:20

This issue can sometimes (every time in my experience) be addressed by running the "Refresh Trusted Security Token Services Metadata feed" -- just look under "Timer Jobs" under "Monitoring" in Central Administration.

This is one of those timer jobs which runs infrequently (in this case once per day, usually at midnight), so unless you kick it off explicitly it can be a mystery when things that don't run one day run the next.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.