properties:
  login:
    oauth:
      providers:
        google:
          type: oidc1.0
          authUrl: https://accounts.google.com/o/oauth2/v2/auth
          tokenUrl: https://www.googleapis.com/oauth2/v4/token
          issuer: https://accounts.google.com
          redirectUrl: (( concat "https://login." properties.system_domain "/uaa" ))
          scopes:
            - openid
            - email
          linkText: Login with Google
          showLinkText: true
          addShadowUserOnLogin: false
          relyingPartyId: (( grab $OAUTH_CLIENT_ID ))
          relyingPartySecret: (( grab $OAUTH_CLIENT_SECRET ))
          skipSslValidation: false
          attributeMappings:
            user_name: email

properties:
  login:
    oauth:
      providers:
        google:
          type: oidc1.0
          authUrl: https://accounts.google.com/o/oauth2/v2/auth
          tokenUrl: https://www.googleapis.com/oauth2/v4/token
          tokenKeyUrl: https://www.googleapis.com/oauth2/v3/certs
          issuer: https://accounts.google.com
          redirectUrl: (( concat "https://login." properties.system_domain "/uaa" ))
          scopes:
            - openid
            - email
          linkText: Login with Google
          showLinkText: true
          addShadowUserOnLogin: false
          relyingPartyId: (( grab $OAUTH_CLIENT_ID ))
          relyingPartySecret: (( grab $OAUTH_CLIENT_SECRET ))
          skipSslValidation: false
          attributeMappings:
            user_name: email

Enable validation of google OIDC signatures
Enable validation of google OIDC signatures

Prior to our v251 to v253 CF upgrade, logging in with google OpenID Connect
seemed to be working, however once we'd upgraded to v253 we encountered the
error: "There was an error when authenticating against the external identity
provider: Could not verify token signature."

As suggested in https://github.com/cloudfoundry/uaa/issues/565, a tokenKeyURL
has been added.  https://www.googleapis.com/oauth2/v3/certs was used instead of
the URL suggested there, as this is the URL returned from
https://accounts.google.com/.well-known/openid-configuration
