CWWKS1708E: Unable to Contact OpenID Connect Provider – Certificate Issue
Hello,
I’m facing an issue while setting up OpenID Connect (OIDC) with Google as the provider in my Liberty/JAS environment. The error message I’m encountering is:
CWWKS1708E: The OpenID Connect client [766940859173-mnphhuhn2ku0trr1e5bvl8rugcbdi6e2.apps.googleusercontent.com] is unable to contact the OpenID Connect provider at [https://oauth2.googleapis.com/token] to receive an ID token due to [java.security.cert.CertificateException: unable to find valid certification path to requested target].
It seems that the client is unable to establish a trust relationship with the Google OIDC provider due to a certificate issue. Below is the configuration I am using for the OIDC login:
<oidcLogin id="jazzop" displayName="OIDC Login"
clientId="*********"
clientSecret="*********"
authorizationEndpoint="https://accounts.google.com/o/oauth2/v2/auth"
tokenEndpoint="https://oauth2.googleapis.com/token"
issuer="https://accounts.google.com"
signatureAlgorithm="RS256"
trustStoreRef="defaultTrustStore"
scope="openid profile email"
userNameAttribute="email"
mapToUserRegistry="true">
</oidcLogin>
Steps Taken:
-
I've confirmed that the root certificate used by
oauth2.googleapis.comis not in the truststore. - I attempted to download the necessary Google Root CA certificate but am unsure if I’m downloading the correct one or how to import it properly into my truststore.
My Environment:
- Liberty/JAS server
-
Using
defaultTrustStorefor certificate management - OIDC provider: Google
Could anyone guide me on:
- Identifying and downloading the correct certificate for the Google OIDC provider?
-
Importing this certificate into the correct truststore (
defaultTrustStore)? - Verifying that the truststore is properly configured to resolve this issue?
Any advice would be greatly appreciated. Thanks!
One answer
You're definitely on the right path there. You need to load the correct certificate chain (and Google will have multiple intermediate certificates as well as a root) into the correct CA root store being used by the JAS server to run.
Note that this is likely not the truststore you are using, but the cacerts in the Java JRE directory that's running the server (usually <JDK>/jre/lib/security).
With regard to the certificates you need, you can use a web browser and hit any of the URLS in your question above, and examine the certificate information for accounts.google.com. You will be able to open the certificate and see the whole chain required, and even be able to export them as files from your browser