I have looked the code of Java example (Revision 557).
Dose the example implements that the Service Provider asks the User if
the Consumer can access the Protected Resources after verifying the
User's identity?
OAuth specification says "The User MUST grant or deny permission ..."
on 6.2.2.
AuthorizationServlet and authorize.jsp ask the user to identify
herself. At this point, a real service provider would authenticate
the user and ask for permission.
> I have looked the code of Java example (Revision 557).
> Dose the example implements that the Service Provider asks the User if
> the Consumer can access the Protected Resources after verifying the
> User's identity?
I got the Java implementation, run the application and read the spec
again. I found you are right.
OAuth specification doesn't say that the Service Provider should have
an authentication page and a permission page.
