I have an issue to call oauth authorization server to generate access token on websphere liberty core 20.0.0.10
To generate an access token, which will allow me to reach some APIs, I tried to reach the oauth2 server in this way like this:
logger.log(Level.INFO, "------ Get Access Token Start ------ ");
ResponseEntity<String> response = null;
RestTemplate restTemplate = new RestTemplate();
String credentials = "client-id:client-server";
String encodedCredentials = new String(Base64.encodeBase64(credentials.getBytes()));
String scope = "openid";
HttpHeaders headers = new HttpHeaders();
headers.setAccept(Arrays.asList(MediaType.APPLICATION_JSON));
headers.add("Authorization", "Basic " + encodedCredentials);
HttpEntity<String> request = new HttpEntity<>(headers);
String access_token_url = "https://xxx/oauth2/token";
access_token_url += "&scope=" + scope;
access_token_url += "&grant_type=client_credentials";
response = restTemplate.exchange(access_token_url, HttpMethod.POST, request, String.class);
try {
String accessTokenResponse = objectMapper.writeValueAsString(response.getBody());
logger.log(Level.INFO,"accessTokenResponse {0}", accessTokenResponse);
} catch (JsonProcessingException e) {
logger.log(Level.SEVERE, DomainConstants.JSON_PARSE_ERROR, e);
}
logger.log(Level.INFO, "------ Get Access Token End ------ ");
In wlp server, on server.xml file, I have added trustDefaultCerts="true"
</featureManager>
<ssl id="defaultSSLConfig" keyStoreRef="defaultKeyStore" trustDefaultCerts="true" />
<!--<variable name="defaultHostName" value="localhost" /> -->
<keyStore id="defaultKeyStore" location="D:\server\wlp-20.0.0.10\usr\servers\testServer\resources\security\certificate.p12" type="PKCS12" password="secret" />
I am still getting the exception
[ERROR ] CWPKI0823E: SSL HANDSHAKE FAILURE: A signer with SubjectDN [CN=xxx, ...] was sent from the host [xxx:443]. The signer might need to be added to local trust store [D:/server/wlp-20.0.0.10/usr/servers/testServer/resources/security/certificate.p12], located in SSL configuration alias [defaultSSLConfig]. The extended error message from the SSL handshake exception is: [PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target].
[ERROR ] CWPKI0828E: The trustDefaultCerts attribute is enabled but trust was not established by using the default truststore. The extended error message from the SSL handshake exception is: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.
[2022-07-27 23:03:28] [ERROR] [Thread:Default Executor-thread-5]
[TOKEN:] [c.b.r.r.h.GlobalControllerExceptionHandler] [GlobalControllerExceptionHandler] buildResponseEntity - propagation erreur oven http : I/O error on POST request for "https://xxx/oauth2/token&scope=openid&grant_type=client_credentials": java.security.cert.CertificateException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://inner-api-dev-ext.axa-ma.corp.intraxa/oauth2/token&scope=openid&grant_type=client_credentials": java.security.cert.CertificateException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException ...
How can I create a certification which can allow me to call the authorization server from websphere liberty or allow outgoing ssl connections to this server ?