I spent a decent amount of time helping a coworker setting up SignPost with our OAuth infrastructure. The problem we ran into was that he had called setTokenWithSecret before calling setMessageSigner. Calling setMessageSigner will cause AbstractOAuthConsumers to lose the token secret, this limitation does not appear to be documented (at least not in the API documentation).
public void setTokenWithSecret(String token, String tokenSecret) {
this.token = token;
messageSigner.setTokenSecret(tokenSecret);
}
Ideally this should be changed or documented.
Christian