CA Access Gateway (SPS) Google Social Login Fails with HTTP 500 Error After Redirect to /affwebservices

Products

SITEMINDER

Issue/Introduction

This article addresses an issue encountered when integrating CA Access Gateway (SPS) with Google for Social Single Sign-On (SSO).

After signing in to Google, the redirect to /affwebservices fails with an HTTP 500 error.

The Federation trace log (FWSTrace.log) shows the following error, although the underlying configuration problem is not obvious from the message alone:

[12/02/2021][19:43:35][18640][140300370945792][][MessageDispatcher.java][dispatchMessage][Dispatcher object thrown an exception while processing the message. SrcaException Message: HTTP status line was not returned: Possible cause is timeout before response received from remote service.
Message contents =
[Headers:{}]
[Cookies:{}]
[Message: ].]
[12/02/2021][19:43:35][18640][140300370945792][][MessageDispatcher.java][dispatchMessage][Exception:
com.netegrity.srca.SrcaException: HTTP status line was not returned: Possible cause is timeout before response received from remote service.
Message contents =
[Headers:{}]
[Cookies:{}]

Environment

- CA Access Gateway (SPS) 12.8.x, and 12.9

Cause

The Google Root CA certificate was not properly added to the Policy Store.

As a result, CA Access Gateway (SPS) is unable to validate the SSL/TLS certificate presented by the Google API server when exchanging the authorization "code" for an access token.

Troubleshooting steps used to identify the cause:

Exchange the authorization code for an access token manually, using the Google token API, to confirm the code itself is valid (1):

# curl -L -X POST 'https://www.googleapis.com/oauth2/v4/token?client_id=<client-id>&client_secret=<client-secret>&redirect_uri=https%3A%2F%2Fsso01.example.com%2Faffwebservices%2Fpublic%2Foauthtokenconsumer%2F<client-id>' \
--data grant_type=authorization_code \
--data 'code=<code>' \
--verbose --silent

Running this command directly on the CA Access Gateway (SPS) server completes successfully, confirming there is no issue with the authorization code itself.
Capture network traffic on the Access Gateway (Linux environment) while reproducing the error in the browser:

# tcpdump -nn -s 0 -i any -w /tmp/https.pcap port 443
# tshark -r /tmp/https.pcap | less

The packet capture shows a certificate error, indicating that CA Access Gateway (SPS) fails to establish an SSL/TLS connection to the Google API server.

In a working scenario, when the CA Access Gateway (SPS) Federation service connects to the Google URLs, it retrieves the CA certificates from the Policy Server. The following lines appear in the FWSTrace.log just before the error reported above:

[07/15/2026][09:06:14][09:06:14.052][61788][140131161863744][][FederationTunnelClient.java][getAllCAcerts][Tunnel result code: 1.]
[07/15/2026][09:06:14][09:06:14.061][61788][140131161863744][][FederationTunnelClient.java][getAllCAcerts][Number of CA certificates received:3]
[07/15/2026][09:06:14][09:06:14.062][61788][140131161863744][][FederationTunnelClient.java][getAllCAcerts][Subject DN of last certificate received: CN=GTS Root R1,O=Google Trust Services LLC,C=US]
[07/15/2026][09:06:14][09:06:14.062][61788][140131161863744][][FederationTunnelClient.java][getAllCAcerts][Number of CA certificates copied to output:3]
[07/15/2026][09:06:14][09:06:14.062][61788][140131161863744][][FWSBase.java][getAllCAcerts][Obtained CA certificates from policy server. Total Certs received: 3]

The Google Root CA certificate should be included among these certificates. If it is missing, the TLS handshake with the Google API server fails, producing the HTTP 500 error described above.

Resolution

Download the Google Trust Services Root certificate by accessing the Google API URL (2) from the CA Access Gateway (SPS) machine.
Import the certificate into the Administrative UI, under Infrastructure > X.509 Certificate Management > Certificate Authorities.
Restart CA Access Gateway (SPS).