Author: rbaxter85
Date: Wed Jul 25 00:08:02 2012
New Revision: 1365361
URL: http://svn.apache.org/viewvc?rev=1365361&view=rev
Log:
SHINDIG-1775
Committed For Adam Clarke
OAuth1.0a , Make oauth_body_hash optional and support PLAINTEXT
Modified:
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStore.java
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStoreConsumerKeyAndSecret.java
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthStore.java
Modified:
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStore.java
URL:
http://svn.apache.org/viewvc/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStore.java?rev=1365361&r1=1365360&r2=1365361&view=diff
==============================================================================
---
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStore.java
(original)
+++
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStore.java
Wed Jul 25 00:08:02 2012
@@ -52,6 +52,7 @@ public class BasicOAuthStore implements
private static final String CONSUMER_KEY_KEY = "consumer_key";
private static final String KEY_TYPE_KEY = "key_type";
private static final String CALLBACK_URL = "callback_url";
+ private static final String OAUTH_BODY_HASH_KEY = "bodyHash";
/**
* HashMap of provider and consumer information. Maps
BasicOAuthStoreConsumerIndexs (i.e.
@@ -131,15 +132,22 @@ public class BasicOAuthStore implements
String consumerSecret = consumerInfo.getString(CONSUMER_SECRET_KEY);
String consumerKey = consumerInfo.getString(CONSUMER_KEY_KEY);
String keyTypeStr = consumerInfo.getString(KEY_TYPE_KEY);
+ boolean oauthBodyHash = true;
+ String oauthBodyHashString = consumerInfo.optString(OAUTH_BODY_HASH_KEY);
+ if ("false".equalsIgnoreCase(oauthBodyHashString)) {
+ oauthBodyHash = false;
+ }
KeyType keyType = KeyType.HMAC_SYMMETRIC;
if ("RSA_PRIVATE".equals(keyTypeStr)) {
keyType = KeyType.RSA_PRIVATE;
consumerSecret = convertFromOpenSsl(consumerSecret);
+ } else if ("PLAINTEXT".equals(keyTypeStr)) {
+ keyType = KeyType.PLAINTEXT;
}
BasicOAuthStoreConsumerKeyAndSecret kas = new
BasicOAuthStoreConsumerKeyAndSecret(
- consumerKey, consumerSecret, keyType, null, callbackUrl);
+ consumerKey, consumerSecret, keyType, null, callbackUrl,
oauthBodyHash);
BasicOAuthStoreConsumerIndex index = new BasicOAuthStoreConsumerIndex();
index.setGadgetUri(gadgetUri.toASCIIString());
@@ -185,13 +193,17 @@ public class BasicOAuthStore implements
"No key for gadget " + securityToken.getAppUrl() + " and service " +
serviceName);
}
OAuthConsumer consumer;
- if (cks.getKeyType() == KeyType.RSA_PRIVATE) {
+ final KeyType keyType = cks.getKeyType();
+ if (keyType == KeyType.RSA_PRIVATE) {
consumer = new OAuthConsumer(null, cks.getConsumerKey(), null, provider);
// The oauth.net java code has lots of magic. By setting this property
here, code thousands
// of lines away knows that the consumerSecret value in the consumer
should be treated as
// an RSA private key and not an HMAC key.
consumer.setProperty(OAuth.OAUTH_SIGNATURE_METHOD, OAuth.RSA_SHA1);
consumer.setProperty(RSA_SHA1.PRIVATE_KEY, cks.getConsumerSecret());
+ } else if (keyType == KeyType.PLAINTEXT) {
+ consumer = new OAuthConsumer(null, cks.getConsumerKey(),
cks.getConsumerSecret(), provider);
+ consumer.setProperty(OAuth.OAUTH_SIGNATURE_METHOD, "PLAINTEXT");
} else {
consumer = new OAuthConsumer(null, cks.getConsumerKey(),
cks.getConsumerSecret(), provider);
consumer.setProperty(OAuth.OAUTH_SIGNATURE_METHOD, OAuth.HMAC_SHA1);
@@ -202,7 +214,7 @@ public class BasicOAuthStore implements
callback = callback.replace("%authority%", authority.getAuthority());
}
- return new ConsumerInfo(consumer, cks.getKeyName(), callback);
+ return new ConsumerInfo(consumer, cks.getKeyName(), callback,
cks.isOauthBodyHash());
}
private BasicOAuthStoreTokenIndex makeBasicOAuthStoreTokenIndex(
Modified:
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStoreConsumerKeyAndSecret.java
URL:
http://svn.apache.org/viewvc/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStoreConsumerKeyAndSecret.java?rev=1365361&r1=1365360&r2=1365361&view=diff
==============================================================================
---
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStoreConsumerKeyAndSecret.java
(original)
+++
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/BasicOAuthStoreConsumerKeyAndSecret.java
Wed Jul 25 00:08:02 2012
@@ -23,7 +23,7 @@ package org.apache.shindig.gadgets.oauth
*/
public class BasicOAuthStoreConsumerKeyAndSecret {
- public static enum KeyType { HMAC_SYMMETRIC, RSA_PRIVATE }
+ public static enum KeyType { HMAC_SYMMETRIC, RSA_PRIVATE, PLAINTEXT }
/** Value for oauth_consumer_key */
private final String consumerKey;
@@ -40,13 +40,21 @@ public class BasicOAuthStoreConsumerKeyA
/** Callback URL associated with this consumer key */
private final String callbackUrl;
+ private final boolean oauthBodyHash;
+
+ public BasicOAuthStoreConsumerKeyAndSecret(String key, String secret,
KeyType type, String name,
+ String callbackUrl) {
+ this(key, secret, type, name, callbackUrl, true);
+ }
+
public BasicOAuthStoreConsumerKeyAndSecret(String key, String secret,
KeyType type, String name,
- String callbackUrl) {
+ String callbackUrl, boolean oauthBodyHash) {
consumerKey = key;
consumerSecret = secret;
keyType = type;
keyName = name;
this.callbackUrl = callbackUrl;
+ this.oauthBodyHash = oauthBodyHash;
}
public String getConsumerKey() {
@@ -68,4 +76,8 @@ public class BasicOAuthStoreConsumerKeyA
public String getCallbackUrl() {
return callbackUrl;
}
+
+ public boolean isOauthBodyHash() {
+ return this.oauthBodyHash;
+ }
}
Modified:
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java
URL:
http://svn.apache.org/viewvc/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java?rev=1365361&r1=1365360&r2=1365361&view=diff
==============================================================================
---
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java
(original)
+++
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java
Wed Jul 25 00:08:02 2012
@@ -47,6 +47,7 @@ import org.apache.shindig.gadgets.http.H
import org.apache.shindig.gadgets.http.HttpResponseBuilder;
import org.apache.shindig.gadgets.oauth.AccessorInfo.HttpMethod;
import org.apache.shindig.gadgets.oauth.AccessorInfo.OAuthParamLocation;
+import org.apache.shindig.gadgets.oauth.OAuthStore.ConsumerInfo;
import org.apache.shindig.gadgets.oauth.OAuthStore.TokenInfo;
import org.json.JSONObject;
@@ -345,7 +346,7 @@ public class OAuthRequest {
addCallback(requestTokenParams);
- HttpRequest signed = sanitizeAndSign(request, requestTokenParams, true);
+ HttpRequest signed = sanitizeAndSign(request, requestTokenParams, true,
this.accessorInfo.getConsumer().isOauthBodyHash());
OAuthMessage reply = sendOAuthMessage(signed);
@@ -518,7 +519,7 @@ public class OAuthRequest {
* Send it.
*/
public HttpRequest sanitizeAndSign(HttpRequest base, List<Parameter> params,
- boolean tokenEndpoint) throws OAuthRequestException {
+ boolean tokenEndpoint, boolean addBodyHash) throws OAuthRequestException
{
if (params == null) {
params = Lists.newArrayList();
}
@@ -540,14 +541,16 @@ public class OAuthRequest {
}
break;
case URL_AND_BODY_HASH:
- try {
- byte[] body = IOUtils.toByteArray(base.getPostBody());
- byte[] hash = DigestUtils.sha(body);
- String b64 = CharsetUtil.newUtf8String(Base64.encodeBase64(hash));
- params.add(new Parameter(OAuthConstants.OAUTH_BODY_HASH, b64));
- } catch (IOException e) {
- throw new OAuthRequestException(OAuthError.UNKNOWN_PROBLEM,
- "Error taking body hash", e);
+ if (addBodyHash) {
+ try {
+ byte[] body = IOUtils.toByteArray(base.getPostBody());
+ byte[] hash = DigestUtils.sha(body);
+ String b64 = CharsetUtil.newUtf8String(Base64.encodeBase64(hash));
+ params.add(new Parameter(OAuthConstants.OAUTH_BODY_HASH, b64));
+ } catch (IOException e) {
+ throw new OAuthRequestException(OAuthError.UNKNOWN_PROBLEM,
+ "Error taking body hash", e);
+ }
}
break;
}
@@ -556,7 +559,9 @@ public class OAuthRequest {
// trusted parameters have ability to override these parameters.
List<Parameter> authParams = Lists.newArrayList();
- addIdentityParams(authParams);
+ if (addBodyHash) {
+ addIdentityParams(authParams);
+ }
addSignatureParams(authParams);
@@ -767,7 +772,7 @@ public class OAuthRequest {
}
}
- HttpRequest signed = sanitizeAndSign(request, msgParams, true);
+ HttpRequest signed = sanitizeAndSign(request, msgParams, true,
this.accessorInfo.getConsumer().isOauthBodyHash());
OAuthMessage reply = sendOAuthMessage(signed);
@@ -846,7 +851,7 @@ public class OAuthRequest {
// This is a request for access token data, return it.
builder = formatAccessTokenData();
} else {
- HttpRequest signed = sanitizeAndSign(realRequest, null, false);
+ HttpRequest signed = sanitizeAndSign(realRequest, null, false,
this.accessorInfo.getConsumer().isOauthBodyHash());
HttpResponse response = fetchFromServer(signed);
Modified:
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthStore.java
URL:
http://svn.apache.org/viewvc/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthStore.java?rev=1365361&r1=1365360&r2=1365361&view=diff
==============================================================================
---
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthStore.java
(original)
+++
shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthStore.java
Wed Jul 25 00:08:02 2012
@@ -54,6 +54,7 @@ public interface OAuthStore {
private final OAuthConsumer consumer;
private final String keyName;
private final String callbackUrl;
+ private final boolean oauthBodyHash;
/**
* @param consumer the OAuth consumer
@@ -63,9 +64,21 @@ public interface OAuthStore {
* shindig server.
*/
public ConsumerInfo(OAuthConsumer consumer, String keyName, String
callbackUrl) {
+ this(consumer, keyName, callbackUrl, true);
+ }
+
+ /**
+ * @param consumer the OAuth consumer
+ * @param keyName the name of the key to use for this consumer (passed on
query parameters to
+ * help with key rotation.)
+ * @param callbackUrl callback URL associated with this consumer, likely
to point to the
+ * shindig server.
+ */
+ public ConsumerInfo(OAuthConsumer consumer, String keyName, String
callbackUrl, boolean oauthBodyHash) {
this.consumer = consumer;
this.keyName = keyName;
this.callbackUrl = callbackUrl;
+ this.oauthBodyHash = oauthBodyHash;
}
public OAuthConsumer getConsumer() {
@@ -79,6 +92,10 @@ public interface OAuthStore {
public String getCallbackUrl() {
return callbackUrl;
}
+
+ public boolean isOauthBodyHash() {
+ return this.oauthBodyHash;
+ }
}
/**
