John, Great! I will send the patch to you as soon as I take care of some red- tapes.
I will also add some test-cases for the changes I make. The problem with current test-case is that it uses the PEM file defined in Java code, which removed the PEM markers like "-----BEGIN PRIVATE KEY". I like to test against the real files generated by OpenSSL as is. It's kind of tricky to use files in JUnit because working directories maybe different depending on who is running the JUnit. I normally take care of the problem for Maven and Eclipse. It may not work on other IDEs. Do you think this is good enough? I also need to test RSA signing against a real provider. We don't support RSA so I use Google for this. Google only allows one consumer per domain. I don't have an extra key to share. I wonder if anyone from Google can create a fake consumer for testing purposes and share the private key with us? Thanks! Zhihong On Apr 18, 5:25 pm, John Kristian <[email protected]> wrote: > Thank you for your contribution, Zhihong. If you'll send me a patch, > I'll be happy to commit it to oauth-core. > > Can anyone provide some test cases, for this? It would be best to > have several people check to be sure it's correct. I'm not well > qualified. > > On Apr 18, 9:28 am, Zhihong <[email protected]> wrote: > > > The RSA key handling is very flexible in Java library. You can provide > > keys in various formats. However, the PEM file for private key is not > > handled correctly. We don't support RSA ourselves so I didn't test PEM > > for cert/public key. I am pretty sure it doesn't work either by > > looking at the code. > > > I patched the code to correct PKCS#8 PEM handling. I just realized > > that the patch is overwritten in a recent update. I like to contribute > > the code back so i don't have to patch it again. What's the procedure > > to do this? > > > In our client, I also added support for more popular PKCS#1 encoded > > PEM files (default format for OpenSSL). I can contribute that code > > also. PKI is optimized for public key, which has a small exponent. > > Private key operation (like signing) is very expensive. PKCS#1 with > > all the CRT parameters can improve signing performance. > > > Zhihong --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "OAuth" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/oauth?hl=en -~----------~----~----~----~------~----~------~--~---
