2 legged Authentication

[San]

Can signpost can be used for 2 legged authentication? If yes can you
please provide the flow
and an example with source code.

Thanks

[matthias]

Hi,

as far as I know, 2-legged OAuth is NOT standardized, and it simply
means that the token exchange phase (the "dance") is skipped. Instead,
an empty token is sent, and it's the responsibility of the service
provider to authenticate the consumer using the consumer key (and the
signature generated using the consumer secret).

I haven't tested Signpost in 2-legged scenarios, but what you may want
to try is this:

// do not set a token or token secret on this consumer
consumer.setSendEmptyTokens(true);
consumer.sign(request);
request.send();

please let me know if that works for you.

[San]

I will try the solution. I need to setup first and check how it
works.
I will let you know the result.

So your suggestion is:-

OAuthConsumer consumer = new
DefaultOAuthConsumer(CONSUMER_KEY,

CONSUMER_SECRET);

Replace the following statement :-
consumer.setTokenWithSecret(ACCESS_TOKEN,
TOKEN_SECRET);
with the statement:-
consumer.setSendEmptyTokens(true);

// create an HTTP request to a protected resource
URL url = new URL("http://example.com/protected");
HttpURLConnection request = (HttpURLConnection)
url.openConnection();

// sign the request
consumer.sign(request);

// send the request
request.send();

Hope I got you right.

Thanks

> > Thanks- Hide quoted text -
>
> - Show quoted text -

[Matthias Käppler]

Yes that looks about right

> as far as I know, 2-legge...

> > Thanks- Hide quoted text -
>
> - Show quoted text -

--
You received this message because you are subscribed to the Google Groups "Signpost users" grou...

[Guoguo Lu]

So how does the validation looks like with sign-post API?

I tried to search the documentation for it, but didn't figure out how to validate signature.

The header I receive looks like this:

Authorization:

OAuth oauth_consumer_key="snowball-7544", 

oauth_nonce="8275654198145185499", 

oauth_signature="Yv2P8Z5dNf1KeOrya5bcUIQ0%2BNk%3D", 

oauth_signature_method="HMAC-SHA1", 

oauth_timestamp="1389666398", 

oauth_version="1.0"