I see there is a difference between base64 and base64url encoding ...

url - String based data encoding: Base64 vs Base64url - Stack Overflow
 

I added this line in my code:

Set jwt = $Translate(jwt,"+/=","-_")

I have updated flags to 1 to remove CR/LF.

I still see Invalid Signature warning in jwt.io

When I paste the jwt at https://jwt.io/, I see:

invalid signature

I have updated my code as follows:

ClassMethod test2() As %Status

{

    #Dim sigJOSE As %DynamicObject

    #Dim encJOSE As %DynamicObject

    #Dim claims As %DynamicObject

    Set ts = $ZTIMESTAMP  // 67161,81327.6633447

    Set exp = ##class(%OAuth2.Utils).TimeInSeconds(ts,300)

    Set nbf = ##class(%OAuth2.Utils).TimeInSeconds(ts,0)

    Set iat = ##class(%OAuth2.Utils).TimeInSeconds(ts,0)

    Set sigJOSE = {}

    Set sigJOSE.alg = "RS384"

    Set sigJOSE.typ = "JWT"

    Set header = sigJOSE.%ToJSON()

    Set claims = {}

    Set claims.iss = "863e73c5-9839-4b54-8205-c9404d2bb762"

    Set claims.sub = claims.iss

    Set claims.aud = "https://fhir.epic.com/interconnect-fhir-oauth/oauth2/token"

    Set claims.jti = "f9eaafba-2e49-11ea-8880-5ce0c5aee679"

    Set claims.exp = exp

    Set claims.nbf = nbf

    Set claims.iat = iat

    Set payload = claims.%ToJSON()

    //Set sigJWKS = ..MyKeys()

    //Set encJWKS = ""

    //Set tSC = ##class(%Net.JSON.JWT).Create(sigJOSE,{},claims,sigJWKS,encJWKS,.JWT)

    //Do $System.Status.DisplayError(tSC)

    Set bitLength = 384

    Set flags = 0

    Set tData = ##class(%SYSTEM.Encryption).Base64Encode(header,flags)_"."_##class(%SYSTEM.Encryption).Base64Encode(payload,flags)

    Set key = ..PrivateKey()

    //Set privKeyPassword = ""

    Set signature = ##class(%SYSTEM.Encryption).RSASHA3Sign(bitLength, tData, key)

    Set jwt = tData_"."_##class(%SYSTEM.Encryption).Base64Encode(signature,flags)

    Set pad = "="

    Set jwt = $Translate(jwt,pad,"")

    Set delim = $Char(13,10)

    For ii = 1:1:$Length(jwt,delim) {

        Write $Piece(jwt,delim,ii),!

    }

    Quit jwt

}

I had generated a signature in variable x. I forgot the next step:

The full JWT is constructed by combining the header, body and signature as follows:

base64urlEncoding(header) + '.' + base64urlEncoding(payload) + '.' + base64urlEncoding(signature)

That works. Thank you, Jeffrey

I wonder if I can use JOB to invoke a routine and specify a file as the input device. Does anybody know how to do this?

I realize that my HTML contains references to css files. I do not yet have the css files where pandoc is running.

Maybe I have not installed enough for pandoc to work properly in my container. Are there other tools for programmatically creating pdf (from html)?

The first file I tried to convert to PDF displays at the source system, but it does not look exactly as expected. I copy ther pdf to csp directory and display it there. I also tried a simple html file and it works correctly end-2-end.

I have seen files transferred inside JSON and I want to try it here. Before (now) I have this code to generate response object:

Set context.Response = ""
 If 1=request.%IsA("EnsLib.HTTP.GenericMessage") {
   If (context.StatusLine = "") {
      Set context.StatusLine = "HTTP/1.1 200 OK"
   }
   If (##class(%File).Exists(context.Outputfile)) {
     Set tStream = ##class(%Stream.FileBinary).%New()
     Set tSC = tStream.LinkToFile(context.Outputfile)
     If $$$ISERR(tSC) Do ##class(Oliver.Util).DebugStatus(tSC)
   }

   //Set tSC = tmp.%Save()
   Set context.Response=##class(EnsLib.HTTP.GenericMessage).%New($Get(tStream),,request.HTTPHeaders)
   Do context.Response.HTTPHeaders.SetAt("application/pdf","Content-Type")
   Do context.Response.HTTPHeaders.SetAt(context.StatusLine,"StatusLine")
   Set tSC = context.Response.%Save()
 }

I confirmed the file is readable and displays correctly.