Package com.google.api.client.auth.oauth

OAuth 1.0 authorization as specified in RFC 5849: The OAuth 1.0 Protocol (see detailed package specification).

See:
Description

Interface Summary

OAuthSigner

OAuth signature method.

Class Summary

AbstractOAuthGetToken	Generic OAuth 1.0a URL to request a temporary or long-lived token from an authorization server.
OAuthAuthorizeTemporaryTokenUrl	OAuth 1.0a URL builder for an authorization web page to allow the end user to authorize the temporary token.
OAuthCallbackUrl	Generic URL that parses the callback URL after a temporary token has been authorized by the end user.
OAuthCredentialsResponse	Data to parse a success response to a request for temporary or token credentials.
OAuthGetAccessToken	Generic OAuth 1.0a URL to request to exchange the temporary credentials token (or "request token") for a long-lived credentials token (or "access token") from an authorization server.
OAuthGetTemporaryToken	Generic OAuth 1.0a URL to request a temporary credentials token (or "request token") from an authorization server.
OAuthHmacSigner	OAuth "HMAC-SHA1" signature method.
OAuthParameters	OAuth 1.0a parameter manager.
OAuthRsaSigner	OAuth "RSA-SHA1" signature method.

Package com.google.api.client.auth.oauth Description

OAuth 1.0 authorization as specified in RFC 5849: The OAuth 1.0 Protocol (see detailed package specification).

There are a few features not supported by this implementation:

• PLAINTEXT signature algorithm
• "application/x-www-form-urlencoded" HTTP request body
• "oauth_*" parameters specified in the HTTP request URL (instead assumes they are specified in the Authorization header)

Before using this library, you may need to set up your application as follows:

1. For web applications, you may need to first register your application with the authorization server. It may provide two pieces of information you need:
   • OAuth Consumer Key: use this as the consumerKey on every OAuth request, for example in AbstractOAuthGetToken.consumerKey.
   • OAuth Consumer Secret: use this as the OAuthHmacSigner.clientSharedSecret when using the "HMAC-SHA1" signature method.
2. For an installed application, an unregistered web application, or a web application running on localhost, you must use the "HMAC-SHA1" signature method. The documentation for the authorization server will need to provide you with the consumerKey and clientSharedSecret to use.
3. For the "HMAC-SHA1" signature method, use OAuthHmacSigner.
4. For the "RSA-SHA1" signature method, use OAuthRsaSigner.

After the set up has been completed, the typical application flow is:

1. Request a temporary credentials token from the Authorization server using OAuthGetTemporaryToken. A callback URL should be specified for web applications, but does not need to be specified for installed applications.
2. Direct the end user to an authorization web page to allow the end user to authorize the temporary token using using OAuthAuthorizeTemporaryTokenUrl.
3. After the user has granted the authorization:
   • For web applications, the user's browser will be redirected to the callback URL which may be parsed using OAuthCallbackUrl.
   • For installed applications, see the authorization server's documentation for figuring out the verification code.
4. Request to exchange the temporary token for a long-lived access token from the Authorization server using OAuthGetAccessToken. This access token must be stored.
5. Use the stored access token to authorize HTTP requests to protected resources by setting the OAuthParameters.token and invoking OAuthParameters.signRequestsUsingAuthorizationHeader(com.google.api.client.http.HttpTransport).

Warning: this package is experimental, and its content may be changed in incompatible ways or possibly entirely removed in a future version of the library

Since:

1.0

Author:

Yaniv Inbar