Generating Google OAuth2 token using GoogleCredentials

[Roshan2410002]

Hi,

We are trying the generate the Google Oauth2 token using the GoogleCredentials which reads authentication details using the json provided below in AEM as a Cloud Service:-

test.json file (placed user project core module- core/src/main/resources/test.json)

Note: Actual values are replaced with test for security reasons.

{
"type": "test",
"project_id": "test",
"private_key_id": "test",
"private_key": "test",
"client_email": "test@gmail.com",
"client_id": "test",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "test",
"universe_domain": "googleapis.com"
}

We have included all the dependencies as mentioned below for the google oauth2.

<!-- https://mvnrepository.com/artifact/com.google.auth/google-auth-library-oauth2-http -->
<dependency>
    <groupId>com.google.auth</groupId>
    <artifactId>google-auth-library-oauth2-http</artifactId>
    <version>1.39.1</version>
</dependency>
<!-- https://mvnrepository.com/artifact/com.google.guava/guava -->
<dependency>
    <groupId>com.google.guava</groupId>
    <artifactId>guava</artifactId>
    <version>33.5.0-jre</version>
</dependency>

<!-- https://mvnrepository.com/artifact/com.google.http-client/google-http-client-gson -->
<dependency>
    <groupId>com.google.http-client</groupId>
    <artifactId>google-http-client-gson</artifactId>
    <version>1.47.1</version>
</dependency>

<!-- https://mvnrepository.com/artifact/com.google.http-client/google-http-client-jackson2 -->
<dependency>
    <groupId>com.google.http-client</groupId>
    <artifactId>google-http-client-jackson2</artifactId>
    <version>1.47.1</version>
</dependency>

<!-- https://mvnrepository.com/artifact/com.google.http-client/google-http-client -->
<dependency>
    <groupId>com.google.http-client</groupId>
    <artifactId>google-http-client</artifactId>
    <version>1.47.1</version>
</dependency>


<!-- For Maven (pom.xml) -->
<dependency>
    <groupId>io.opencensus</groupId>
    <artifactId>opencensus-api</artifactId>
    <version>0.31.1</version> <!-- Use the latest stable version -->
</dependency>

<!-- https://mvnrepository.com/artifact/com.google.api-client/google-api-client -->
<dependency>
    <groupId>com.google.api-client</groupId>
    <artifactId>google-api-client</artifactId>
    <version>2.7.2</version>
</dependency>

<dependency>
    <groupId>org.htmlunit</groupId>
    <artifactId>htmlunit-csp</artifactId>
    <version>3.10.0</version>
    <scope>compile</scope>
</dependency>
<dependency>
    <groupId>org.htmlunit</groupId>
    <artifactId>htmlunit-csp</artifactId>
    <version>3.10.0</version>
    <scope>compile</scope>

 In the code we are trying to fetch the idToken of google oauth2 after reading the json values as InputStream :-

try (InputStream serviceAccountStream = getClass().getResourceAsStream("/test.json")) {
GoogleCredentials credentials = GoogleCredentials.fromStream(serviceAccountStream)
.createScoped(Collections.singletonList("https://www.googleapis.com/auth/cloud-platform"));

serviceAccountCredentials = (ServiceAccountCredentials) credentials;

IdTokenCredentials tokenCredentials = IdTokenCredentials.newBuilder()
.setIdTokenProvider((IdTokenProvider) serviceAccountCredentials)
.setTargetAudience(url)
.build();

// Get the token
tokenCredentials.refresh();
String idToken = tokenCredentials.getIdToken().getTokenValue();

}catch (Exception e) {
LOG.info(e.getMessage());
}

We are getting the error in the GoogleCredentials Object 

org.apache.sling.engine.impl.SlingRequestProcessorImpl service: Uncaught Throwable

java.lang.NoClassDefFoundError: com/google/common/base/MoreObjects

at com.google.auth.oauth2.ServiceAccountCredentials.<init>(ServiceAccountCredentials.java:139) 

at com.google.auth.oauth2.ServiceAccountCredentials.fromPkcs8(ServiceAccountCredentials.java:446) 

at com.google.auth.oauth2.ServiceAccountCredentials.fromJson(ServiceAccountCredentials.java:206)

at com.google.auth.oauth2.GoogleCredentials.fromStream(GoogleCredentials.java:296)

at com.google.auth.oauth2.GoogleCredentials.fromStream(GoogleCredentials.java:235)

Kindly let us know if we have missed anything implementing the same.

[giuseppebaglio · Accepted solution]

The error you're encountering is a common issue when trying to use Google OAuth2 libraries in AEM as a Cloud Service. The root cause is that the Google authentication libraries and their dependencies are not OSGi-compliant, which means they work during Maven compilation but fail at runtime in the OSGi environment. 

To resolve this issue, you need to embed all Google dependencies and their transitive dependencies into your OSGi bundle. Here's references for solution:

• https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/com-google-common-base-mor... 
• https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/trying-to-add-google-authe... 

[ManviSharma]

Hello @Roshan2410002 ,

Root cause:
NoClassDefFoundError: com/google/common/base/MoreObjects → Guava class is not available to your bundle at runtime (classloader/OSGi mismatch). Google auth library depends on Guava; AEM Cloud’s OSGi runtime either doesn’t expose the required Guava version or there's a version conflict.

Embed Guava into your bundle (recommended for AEM Cloud Service): use maven-bundle-plugin to embed the Guava jar so it's available inside your bundle.
Example snippet:

<Embed-Dependency>guava</Embed-Dependency>
<Embed-Transitive>true</Embed-Transitive>