@Beta

Package com.google.api.client.auth.oauth

Beta
OAuth 1.0 authorization as specified in RFC 5849: The OAuth 1.0 Protocol (see detailed package specification).

See: Description

Interface Summary

Interface	Description
OAuthSigner	Beta OAuth signature method.

Class Summary

Class	Description
AbstractOAuthGetToken	Beta Generic OAuth 1.0a URL to request a temporary or long-lived token from an authorization server.
OAuthAuthorizeTemporaryTokenUrl	Beta OAuth 1.0a URL builder for an authorization web page to allow the end user to authorize the temporary token.
OAuthCallbackUrl	Beta Generic URL that parses the callback URL after a temporary token has been authorized by the end user.
OAuthCredentialsResponse	Beta Data to parse a success response to a request for temporary or token credentials.
OAuthGetAccessToken	Beta Generic OAuth 1.0a URL to request to exchange the temporary credentials token (or "request token") for a long-lived credentials token (or "access token") from an authorization server.
OAuthGetTemporaryToken	Beta Generic OAuth 1.0a URL to request a temporary credentials token (or "request token") from an authorization server.
OAuthHmacSigner	Beta OAuth "HMAC-SHA1" signature method.
OAuthParameters	Beta OAuth 1.0a parameter manager.
OAuthRsaSigner	Beta OAuth "RSA-SHA1" signature method.

Package com.google.api.client.auth.oauth Description

Beta
OAuth 1.0 authorization as specified in RFC 5849: The OAuth 1.0 Protocol (see detailed package specification).

There are a few features not supported by this implementation:

• PLAINTEXT signature algorithm
• "application/x-www-form-urlencoded" HTTP request body
• "oauth_*" parameters specified in the HTTP request URL (instead assumes they are specified in the Authorization header)

Before using this library, you may need to set up your application as follows:

1. For web applications, you may need to first register your application with the authorization server. It may provide two pieces of information you need:
   • OAuth Consumer Key: use this as the consumerKey on every OAuth request, for example in AbstractOAuthGetToken.consumerKey.
   • OAuth Consumer Secret: use this as the OAuthHmacSigner.clientSharedSecret when using the "HMAC-SHA1" signature method.
2. For an installed application, an unregistered web application, or a web application running on localhost, you must use the "HMAC-SHA1" signature method. The documentation for the authorization server will need to provide you with the consumerKey and clientSharedSecret to use.
3. For the "HMAC-SHA1" signature method, use OAuthHmacSigner.
4. For the "RSA-SHA1" signature method, use OAuthRsaSigner.

After the set up has been completed, the typical application flow is:

1. Request a temporary credentials token from the Authorization server using OAuthGetTemporaryToken. A callback URL should be specified for web applications, but does not need to be specified for installed applications.
2. Direct the end user to an authorization web page to allow the end user to authorize the temporary token using using OAuthAuthorizeTemporaryTokenUrl.
3. After the user has granted the authorization:
   • For web applications, the user's browser will be redirected to the callback URL which may be parsed using OAuthCallbackUrl.
   • For installed applications, see the authorization server's documentation for figuring out the verification code.
4. Request to exchange the temporary token for a long-lived access token from the Authorization server using OAuthGetAccessToken. This access token must be stored.
5. Use the stored access token to authorize HTTP requests to protected resources by setting the OAuthParameters.token and using OAuthParameters as the HttpRequestInitializer.

Since:

1.0

Author:

Yaniv Inbar