title: 403 Forbidden (RP) encountered a failure during the login when configuring App ID with tWAS
body: <p>I'm trying to configure integration between App ID and tWAS. I've followed the 'Overview' of App ID service and successfully configured with Liberty using provided example, but same config is failing for tWAS. What I already did: </p>
  
  <ul>
  <li><p>Configured TAI with the following props:</p>
  
  <pre><code>provider_1.identifier=app-idp
  provider_1.clientId=xxx
  provider_1.clientSecret=zzz
  provider_1.authorizeEndpointUrl=https://eu-gb.appid.cloud.ibm.com/...
  provider_1.tokenEndpointUrl=https://eu-gb.appid.cloud.ibm.com/oauth/...
  provider_1.signatureAlgorithm=RS256
  provider_1.jwkEndpointUrl= https://eu-gb.appid.cloud.ibm.com/oauth/...
  provider_1.interceptedPathFilter=/appContext
  provider_1.redirectToRPHostAndPort=https://host:443
  provider_1.tokenEndpointAuthMethod=basic
  provider_1.issuerIdentifier=https://eu-gb.appid.cloud.ibm.com/oauth...
  </code></pre></li>
  <li><p>Installed OIDCRP</p></li>
  </ul>
  
  <p>When I try to log in, I'm correctly redirected to the App ID login page, but after I provide credentials, it redirects and shows 403 Forbidden.</p>
  
  <p>Here is stack trace, any hints what might be wrong or what am I missing??</p>
  
  <pre><code> [4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU &lt;  getSecuredConnection returns [not null] Exit
   [4/17/19 16:51:28:016 UTC] 000000bf SessionCache  3   getOpServerConnTimeout returns [20000])
   [4/17/19 16:51:28:016 UTC] 000000bf RelyingParty  3   getRevokeEndpoint returns [null]
   [4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU 3   isRevokeEndpoint[false]
   [4/17/19 16:51:28:016 UTC] 000000bf RelyingParty  3   getTokenEndpointAuthMethod returns [basic]
   [4/17/19 16:51:28:016 UTC] 000000bf RelyingPartyU 3   Setting [Authorization] property on request with basicauth info
   [4/17/19 16:51:28:016 UTC] 000000bf RelyingParty  3   getClientBasicAuth returns [Basic OGExZmM2NjQtYTY3Zi00YTk4LWJmM2YtN2E0N2FmYjE4NTdlOk5XTmhaVGN5TVRFdFlUbGhaaTAwTlRkbUxXRTNOemd0TVdSa1lXVTVNelkxTXpWaw==]
   [4/17/19 16:51:28:105 UTC] 000000bf RelyingPartyU 3   Response code: 403
   [4/17/19 16:51:28:105 UTC] 000000bf RelyingPartyU &gt;  getData(inStream[not null]) Entry
   [4/17/19 16:51:28:108 UTC] 000000bf RelyingPartyU &lt;  getData returns [&lt;!DOCTYPE html&gt;
   ....
   [4/17/19 16:51:28:110 UTC] 000000bf RelyingParty  E   CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
   [4/17/19 16:51:28:111 UTC] 000000bf WebAuthentica E   SECJ0126E: Trust Association failed during validation. The exception is com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
           at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:526)
           at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:301)
           at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
           at com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(WebAuthenticator.java:438)
           at com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthenticator.java:3103)
           at com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectIfNeeded(WebCollaborator.java:3522)
           at com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborator.java:851)
           at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebCollaborator.java:447)
           at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
           at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preInvokeCollaborators(CollaboratorHelper.java:436)
           at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1091)
           at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4217)
           at com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppImpl.java:2208)
           at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:304)
           at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1030)
           at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
           at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
           at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
           at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
           at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
           at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
           at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1187)
           at com.ibm.ws.ssl.channel.impl.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:694)
           at com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1833)
           at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
           at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
           at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
           at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
           at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
           at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
           at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
           at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
   . Make sure that the setup is correct and that the user credentials are valid.
   [4/17/19 16:51:28:116 UTC] 000000bf WebCollaborat A   SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [ResponseCode: 403]. Check the logs for details that lead to this exception.
  </code></pre>
  
  <p>Also tried with changing auth method to</p>
  
  <pre><code>provider_1.tokenEndpointAuthMethod=post
  </code></pre>
  
  <p>but same result, attaching full trace from the call <a href="https://ibm.box.com/shared/static/huaovcp0b8e73uedywalxum8xe3gew1t.txt" rel="nofollow noreferrer">trace1.txt</a></p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>After your change and some changes I did in the settings I've moved further. I've reset this setting to Basic</p>
  
  <pre><code>provider_1.tokenEndpointAuthMethod=Basic
  </code></pre>
  
  <p>Now the error is:</p>
  
  <pre><code>[4/18/19 12:07:58:638 UTC] 000000a6 WebCollaborat A   SECJ0056E: Authentication failed for reason CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]]. Check the logs for details that lead to this exception.
  </code></pre>
  
  <p>And trace shows:</p>
  
  <pre><code>[4/18/19 12:07:58:614 UTC] 000000a6 JWT           E   CWWKS1756E: Validation failed for the ID token requested by [....] using the [RS256] algorithm due to a signature verification failure: [JsonObject].
  [4/18/19 12:07:58:617 UTC] 000000a6 SessionData   3   Failed to validate id token, exception thrown during verify [JsonObject]
  
  [4/18/19 12:07:58:629 UTC] 000000a6 WebAuthentica E   SECJ0126E: Trust Association failed during validation. The exception is com.ibm.websphere.security.WebTrustAssociationFailedException: CWTAI2007E: The OpenID Connect relying party (RP) encountered a failure during the login. The exception is [com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]]. Check the logs for details that lead to this exception.
          at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:532)
          at com.ibm.ws.security.oidc.client.RelyingParty.negotiateValidateandEstablishTrust(RelyingParty.java:301)
          at com.ibm.ws.security.web.TAIWrapper.negotiateAndValidateEstablishedTrust(TAIWrapper.java:103)
          at com.ibm.ws.security.web.WebAuthenticator.handleTrustAssociation(WebAuthenticator.java:438)
          at com.ibm.ws.security.web.WebAuthenticator.authenticate(WebAuthenticator.java:3171)
          at com.ibm.ws.security.web.WebCollaborator.SetAuthenticatedSubjectIfNeeded(WebCollaborator.java:3522)
          at com.ibm.ws.security.web.WebCollaborator.authorize(WebCollaborator.java:851)
          at com.ibm.ws.security.web.EJSWebCollaborator.preInvoke(EJSWebCollaborator.java:447)
          at com.ibm.ws.webcontainer.collaborator.WebAppSecurityCollaboratorImpl.preInvoke(WebAppSecurityCollaboratorImpl.java:230)
          at com.ibm.wsspi.webcontainer.collaborator.CollaboratorHelper.preInvokeCollaborators(CollaboratorHelper.java:436)
          at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1091)
          at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4217)
          at com.ibm.ws.webcontainer.webapp.WebAppImpl.handleRequest(WebAppImpl.java:2208)
          at com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.java:304)
          at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1030)
          at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
          at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
          at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
          at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
          at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
          at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
          at com.ibm.ws.ssl.channel.impl.SSLConnectionLink.determineNextChannel(SSLConnectionLink.java:1187)
          at com.ibm.ws.ssl.channel.impl.SSLConnectionLink$MyReadCompletedCallback.complete(SSLConnectionLink.java:694)
          at com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1833)
          at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
          at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
          at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
          at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
          at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
          at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
          at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
          at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
  Caused by: com.ibm.ws.security.oidc.client.RelyingPartyException: Failed to validate id token, exception thrown during verify [JsonObject]
          at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:483)
          at com.ibm.ws.security.oidc.client.SessionData.processJSON(SessionData.java:236)
          at com.ibm.ws.security.oidc.client.SessionData.createData(SessionData.java:166)
          at com.ibm.ws.security.oidc.client.SessionData.&lt;init&gt;(SessionData.java:137)
          at com.ibm.ws.security.oidc.client.SessionCache.createEntry(SessionCache.java:184)
          at com.ibm.ws.security.oidc.client.RelyingPartyUtils.createSessionDataObject(RelyingPartyUtils.java:1299)
          at com.ibm.ws.security.oidc.client.RelyingParty.handleSigninCallback(RelyingParty.java:529)
          ... 31 more
  Caused by: java.lang.UnsupportedOperationException: JsonObject
          at com.google.gson.JsonElement.getAsString(JsonElement.java:191)
          at com.ibm.ws.security.openidconnect.token.JsonTokenUtil.fromJsonToken(JsonTokenUtil.java:154)
          at com.ibm.ws.security.openidconnect.token.JWT.fromJsonToken(JWT.java:553)
          at com.ibm.ws.security.openidconnect.token.JWT.verify(JWT.java:886)
          at com.ibm.ws.security.openidconnect.token.IDToken.verify(IDToken.java:578)
          at com.ibm.ws.security.oidc.client.SessionData.setIdToken(SessionData.java:471)
          ... 37 more
  </code></pre>