java OAuth JAXR设置安全网页
我有一个JAX-RS项目,我需要用OAuth保护一个特定的页面,如果可能的话,我希望所有的东西都在一个类中
关于我搜索的内容,似乎没有合适的指南或教程
以下是我迄今为止尝试过的:
原始类别:
@Path("/topsecret")
@Produces(MediaType.TEXT_PLAIN)
public class TopSecretRestService extends AbstractRestService {
@GET
@Path("/")
public Response getSecret() {
String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
return Response.status(200).entity(output).build();
}
}
StipleSoft的解决方案:(每件事都会出错)
@Path("/topsecret")
@Produces(MediaType.TEXT_PLAIN)
public class TopSecretRestService extends AbstractRestService {
@Path("/")
@GET
public Response authorize(@Context HttpServletRequest request)
throws URISyntaxException, OAuthSystemException {
try {
OAuthAuthzRequest oauthRequest =
new OAuthAuthzRequest(request);
OAuthIssuerImpl oauthIssuerImpl =
new OAuthIssuerImpl(new MD5Generator());
//build response according to response_type
String responseType =
oauthRequest.getParam(OAuth.OAUTH_RESPONSE_TYPE);
OAuthASResponse.OAuthAuthorizationResponseBuilder builder =
OAuthASResponse.authorizationResponse(request,
HttpServletResponse.SC_FOUND);
// 1
if (responseType.equals(ResponseType.CODE.toString())) {
final String authorizationCode =
oauthIssuerImpl.authorizationCode();
database.addAuthCode(authorizationCode);
builder.setCode(authorizationCode);
}
String redirectURI =
oauthRequest.getParam(OAuth.OAUTH_REDIRECT_URI);
final OAuthResponse response = builder
.location(redirectURI)
.buildQueryMessage();
URI url = new URI(response.getLocationUri());
return Response.status(response.getResponseStatus())
.location(url)
.build();
String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
return Response.status(200).entity(output).build();
} catch (OAuthProblemException e) {
// ...
}
}
}
谷歌的解决方案(似乎最简单,但找不到合适的罐子)
@GET
@Path("/")
public Response getSecret() {
OAuthService oauth = OAuthServiceFactory.getOAuthService();
String scope = "https://www.googleapis.com/auth/userinfo.email";
Set<String> allowedClients = new HashSet<>();
allowedClients.add("407408718192.apps.googleusercontent.com"); // list your client ids here
try {
User user = oauth.getCurrentUser(scope);
String tokenAudience = oauth.getClientId(scope);
if (!allowedClients.contains(tokenAudience)) {
throw new OAuthRequestException("audience of token '" + tokenAudience
+ "' is not in allowed list " + allowedClients);
}
// proceed with authenticated user
String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
return Response.status(200).entity(output).build();
} catch (OAuthRequestException ex) {
// handle auth error
// ...
} catch (OAuthServiceFailureException ex) {
// optionally, handle an oauth service failure
// ...
}
}
网站和其他问题:
Securing jax-rs with OAuth——提问者提供的答案非常简短,没有细节
Jax RS REST API - OAuth 2.0 and Control Origin——asker提供的答案,不是同一个问题
http://cxf.apache.org/docs/jax-rs-oauth2.html关于jax rs与oauth2的教程
注意:我对OAuth和jax rs都很陌生
# 1 楼答案
使用JAX-RS编写的最简单的工作示例是java-oauth-server。它是一个授权服务器实现,不仅支持OAuth 2.0(RFC 6749和其他),而且还支持OpenID Connect
如果您寻找的不是授权服务器实现,而是资源服务器实现,请参阅java-resource-server
授权服务器是发布访问令牌的服务器。资源服务器是指访问令牌并返回请求数据的服务器。这两台服务器在逻辑上是不同的,但如果您愿意,可以在一台服务器上实现。我无法确定您要实现哪个服务器
回答者是java oauth服务器和java资源服务器的作者