Package org.eclipse.lyo.server.oauth.webapp.services

Class OAuthService

java.lang.Object

org.eclipse.lyo.server.oauth.webapp.services.OAuthService

@Path("/oauth")
public class OAuthService
extends Object

Issues OAuth request tokens, handles authentication, and then exchanges request tokens for access tokens based on the OAuth configuration set in the OAuthConfiguration singleton.

Author:

Samuel Padgett

See Also:

• The OAuth 1.0 Protocol

Field Summary

Fields

Modifier and Type	Field	Description
protected HttpServletRequest	httpRequest
protected HttpServletResponse	httpResponse

Constructor Summary

Constructors

Constructor	Description
OAuthService()

Method Summary

Modifier and Type	Method	Description
Response	authorize()	Responds with a web page to log in.
Response	authorize(String requestToken)
protected boolean	confirmCallback(OAuthRequest oAuthRequest)
Response	doGetAccessToken()
Response	doGetRequestToken()
Response	doPostAccessToken()	Responds with an access token and token secret for valid OAuth requests.
Response	doPostRequestToken()	Responds with a request token and token secret.
Response	login(String id, String password)	Validates that the ID and password are for an administrator.
Response	login(String id, String password, String requestToken)	Validates the ID and password on the authorization form.
Response	provisionalKey()	Generates a provisional consumer key.
protected Response	respondWithOAuthProblem(net.oauth.OAuthException e)
protected Response	respondWithToken(String token, String tokenSecret)
protected Response	respondWithToken(String token, String tokenSecret, boolean callbackConfirmed)
Response	showApproveKeyPage(String key)	Shows the approval page for a single provisional consumer.
Response	showConsumerKeyManagementPage()	Shows the consumer management page, which allows administrator to approve or remove OAuth consumers.
protected OAuthRequest	validateRequest()	Validates this is a known consumer and the request is valid using OAuthValidator.validateMessage(net.oauth.OAuthMessage, OAuthAccessor).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

httpRequest

@Context
protected HttpServletRequest httpRequest

httpResponse

@Context
protected HttpServletResponse httpResponse

Constructor Details

OAuthService

public OAuthService()

Method Details

doGetRequestToken

@GET
@Path("/requestToken")
public Response doGetRequestToken()
                           throws IOException,
ServletException

Throws:

IOException

ServletException

doPostRequestToken

@POST
@Path("/requestToken")
public Response doPostRequestToken()
                            throws IOException,
ServletException

Responds with a request token and token secret.

Returns:

the response

Throws:

IOException - on I/O errors

ServletException - on servlet errors

authorize

@GET
@Path("/authorize")
public Response authorize()
                   throws ServletException,
IOException

Responds with a web page to log in.

Returns:

the response

Throws:

IOException - on I/O errors

ServletException - on internal errors validating the request

login

@POST
@Path("/login")
public Response login(@FormParam("id")
 String id,
 @FormParam("password")
 String password,
 @FormParam("requestToken")
 String requestToken)

Validates the ID and password on the authorization form. This is intended to be invoked by an XHR on the login page.

Returns:

the response, 409 if login failed or 204 if successful

authorize

@POST
@Path("/internal/approveToken")
public Response authorize(@FormParam("requestToken")
 String requestToken)

doGetAccessToken

@GET
@Path("/accessToken")
public Response doGetAccessToken()
                          throws IOException,
ServletException

Throws:

IOException

ServletException

doPostAccessToken

@POST
@Path("/accessToken")
public Response doPostAccessToken()
                           throws IOException,
ServletException

Responds with an access token and token secret for valid OAuth requests. The request must be signed and the request token valid.

Returns:

the response

Throws:

IOException - on I/O errors

ServletException - on servlet errors

provisionalKey

@POST
@Path("/requestKey")
@Produces("application/json")
public Response provisionalKey()
                        throws NullPointerException,
IOException

Generates a provisional consumer key. This request must be later approved by an administrator.

Returns:

a JSON response with the provisional key

Throws:

IOException

NullPointerException

See Also:

• Jazz Root Services Spec Addendum2

showApproveKeyPage

@GET
@Path("/approveKey")
@Produces("text/html")
public Response showApproveKeyPage(@QueryParam("key")
 String key)
                            throws ServletException,
IOException

Shows the approval page for a single provisional consumer. Shows the consumer management page instead if no key is passed in.

Parameters:

key - the consumer

Returns:

the approve consumer page

Throws:

ServletException - on errors showing the JSP

IOException - on errors showing the JSP

See Also:

• showConsumerKeyManagementPage()

showConsumerKeyManagementPage

@GET
@Path("/admin")
public Response showConsumerKeyManagementPage()
                                       throws ServletException,
IOException

Shows the consumer management page, which allows administrator to approve or remove OAuth consumers.

Returns:

the consumer management page

Throws:

ServletException - on JSP errors

IOException - on JSP errors

login

@POST
@Path("/adminLogin")
public Response login(@FormParam("id")
 String id,
 @FormParam("password")
 String password)

Validates that the ID and password are for an administrator. This is used by the admin login page to protect the OAuth administration pages.

Returns:

the response, 409 if login failed or 204 if successful

confirmCallback

protected boolean confirmCallback(OAuthRequest oAuthRequest)
                           throws net.oauth.OAuthException

Throws:

net.oauth.OAuthException

validateRequest

protected OAuthRequest validateRequest()
                                throws net.oauth.OAuthException,
IOException

Validates this is a known consumer and the request is valid using OAuthValidator.validateMessage(net.oauth.OAuthMessage, OAuthAccessor). Does not check for any tokens.

Returns:

an OAuthRequest

Throws:

net.oauth.OAuthException - if the request fails validation

IOException - on I/O errors

respondWithToken

protected Response respondWithToken(String token,
 String tokenSecret)
                             throws IOException

Throws:

IOException

respondWithToken

protected Response respondWithToken(String token,
 String tokenSecret,
 boolean callbackConfirmed)
                             throws IOException

Throws:

IOException

respondWithOAuthProblem

protected Response respondWithOAuthProblem(net.oauth.OAuthException e)
                                    throws IOException,
ServletException

Throws:

IOException

ServletException