How to get request token for orkut using opensocial java client & fetch activities?

[los]

I'm trying to write a new java webapp and want it to display a user's
activities. I'd like to have this work with orkut to start out, but
hopefully would like to integrate with other opensocial containers
such as linkedin, myspace, etc... I'm currently using the opensocial
java client in my development.

Right now I'm struggling trying to understand how to redirect the user
to orkut from my webapp so he can login if necessary add the
application to their profile, and then redirect this person back to my
webapp so that I can fetch the activities in the background and
display it on my app.

I've noticied that the OpenSocialProvider.ORKUT is defined as:

ORKUT(null, null, null, "http://www.orkut.com/social/rest/",
"http://www.orkut.com/social/rpc/", "orkut.com",
BodySigningMethod.SIGN_BODY_HASH, true),

so there are no urls for requesting a token, authenticating url and
getting the access token. So I started using the
OpenSocialProvider.GOOGLE (since it has actual values for those urls
defined) in my code as follows.


OpenSocialProvider provider = OpenSocialProvider.GOOGLE;
final OpenSocialClient client = new OpenSocialClient
(provider);
client.setProperty(OpenSocialClient.Property.CONSUMER_SECRET,
CONSUMER_SECRET);
client.setProperty(OpenSocialClient.Property.CONSUMER_KEY,
"igoogle.com:1212121212121212");
OpenSocialLoginInfo loginInfo = new OpenSocialLoginInfo();
session.setAttribute(OPEN_SOCIAL_CLIENT, client);
try {
Token token = OpenSocialOAuthClient.getRequestToken
(client, provider);
session.setAttribute("token_secret", token.secret);
String loginUrl = OpenSocialOAuthClient.getAuthorizationUrl
(provider, token, callbackUrl);
....
} catch (Exception e) {
e.printStackTrace();
}

However, I always get the following exception:

Exception in thread "main" java.io.IOException: Container returned
status 400 "Server returned HTTP response code: 400 for URL:
https://www.google.com/accounts/OAuthGetRequestToken?scope=http%3A%2F%2Fsandbox.gmodules.com%2Fapi%2Fpeople&oauth_consumer_key=igoogle.com%3A12121212121212&oauth_signature_method=HMAC-SHA1&oauth_timestamp=1257411304&oauth_nonce=14494432821489&oauth_version=1.0&oauth_signature=ToVMRWpnl3YdxHRi8iIoBsqgurk%3D"
at org.opensocial.client.OpenSocialHttpClient.send
(OpenSocialHttpClient.java:118)
at org.opensocial.client.OpenSocialHttpClient.send
(OpenSocialHttpClient.java:89)
at org.opensocial.client.OpenSocialHttpClient.execute
(OpenSocialHttpClient.java:74)
at org.opensocial.client.OpenSocialHttpClient.execute
(OpenSocialHttpClient.java:45)
at org.opensocial.client.OpenSocialHttpClient.execute
(OpenSocialHttpClient.java:1)
at net.oauth.client.OAuthClient.invoke(OAuthClient.java:243)
at net.oauth.client.OAuthClient.invoke(OAuthClient.java:143)
at net.oauth.client.OAuthClient.getRequestToken(OAuthClient.java:101)
at org.opensocial.client.OpenSocialOAuthClient.getRequestToken
(OpenSocialOAuthClient.java:170)

[Sachin Shenoy]

Hi Carlos,

Before using opensocial java client library, I would suggest you using oauth playground for testing out your authentication part.

http://googlecodesamples.com/oauth_playground/

Here are the values you need to set.

panel(1)

scope (input your own):

http://sandbox.orkut.gmodules.com/socail/rpc

panel(2)

hmac_signature_method:

HMAC-SHA1

Fill in the oauth_consumer_key and secret, and then go ahead with "Request Token", "Authorize" and "Access Token".

Once that is through you should be able to do run some simple requests from.

panel (6)

Set "application/json", method "POST", and body as {'method':'people.get'} and click execute.

Once you succeed here it should be easier for you to figure out what the opensocial library is doing differently.

Regards,

Sachin

[los]

Hi Sachin,

Thanks for the feedback. That playground is a nice tool to know
about.

So I followed your instructions like this:

1. On panel 1 I entered http://sandbox.orkut.gmodules.com/social/rpc
(I corrected the spelling mistake on the word "social")
2. On panel 2 I set oauth_signature_method to HMAC-SHA1
3 Set oauth_consumer_key to orkut.com:121212121212 (I am using
121212... as an example, I set the actual value in my test)
4. Set consumer secret to abcdefabcedfabcdef (Again abcdef... is just
an example I set my correct secret in the test)
5. clicked Request token on panel 3

I got a 400 response, with the result of "Consumer is not registered:
orkut.com:121212121212"

So now I'm thinking that just because I have a consumer key and secret
it doesn't necessarily mean I can make requests to that provider?

All I did to get the key & secret was create a hello world
mygadget.xml file and uploaded it to app engine. Then went to
https://www.google.com/gadgets/directory/verify and entered the url of
my xml file, verified it was mine by updating the xml file with the
token and voila...I got my consumer key and secret.

Feels like I'm just missing a simple detail somewhere. Any ideas what
I'm missing here?

Thanks,

Carlos

> >https://www.google.com/accounts/OAuthGetRequestToken?scope=http%3A%2F...

[Sachin Shenoy]

Hi Carlos,

You need to get 3-legged oauth consumer key / secret. Please follow instructions from the below URL.

http://code.google.com/apis/accounts/docs/RegistrationForWebAppsAuto.html#new

The one you are using will only allow you to make 2-legged oauth calls.

Regards,

Sachin

[los]

Ahhhh, that was it!

This step ought to be be made more clear in the documentation.

Thanks a lot! U da man!! :)

-Carlos

On Nov 9, 9:26 am, Sachin Shenoy <therealsac...@gmail.com> wrote:
> Hi Carlos,
>

> You need to get 3-legged oauth consumer key / secret. Please follow
> instructions from the below URL.
>

> http://code.google.com/apis/accounts/docs/RegistrationForWebAppsAuto....

>
> The one you are using will only allow you to make 2-legged oauth calls.
>
> Regards,

> <http://code.google.com/apis/accounts/docs/RegistrationForWebAppsAuto....>

> Sachin
>
>
>
> On Fri, Nov 6, 2009 at 2:43 AM, los <carlo...@gmail.com> wrote:
>
> > Hi Sachin,
>
> > Thanks for the feedback.  That playground is a nice tool to know
> > about.
>
> > So I followed your instructions like this:
>

> > 1. On panel 1 I enteredhttp://sandbox.orkut.gmodules.com/social/rpc

> > (I corrected the spelling mistake on the word "social")
> > 2. On panel 2 I set oauth_signature_method to HMAC-SHA1
> > 3  Set oauth_consumer_key to orkut.com:121212121212   (I am using
> > 121212... as an example, I set the actual value in my test)
> > 4. Set consumer secret to abcdefabcedfabcdef (Again abcdef... is just
> > an example I set my correct secret in the test)
> > 5. clicked Request token on panel 3
>
> > I got a 400 response, with the result of "Consumer is not registered:
> > orkut.com:121212121212"
>
> > So now I'm thinking that just because I have a consumer key and secret
> > it doesn't necessarily mean I can make requests to that provider?
>
> > All I did to get the key & secret was create a hello world
> > mygadget.xml file and uploaded it to app engine.  Then went to

> >https://www.google.com/gadgets/directory/verifyand entered the url of

[sairam]

hi sachin,
I am trying to access the api provided by orkut using oauth
playground tool similar to what carlos has done.
I went through the link which was sent by you and we followed the
steps using our own domain... the thing upto which we can do is we can
able to get consumer key and consumer secret and the place where we
stuck now is

while managing our domain i came accross a step where it asks for
target url path prefix. i provided http://mydomain/authsub (here my
domain indicates our registed domain). i saved that and tried testing
authsub registration through the link provided .

but grant access failed with the following error mess:
Not Found
The requested URL /authsub was not found on this server.

But still I was able to succeed in oauth playground by selecting
google base in step1 and got the response for step 6.
Again when I tried to get request token by selecting orkut in step1,
by providing the consumer key, secret the following error
message :HTTP/1.1 400 Bad Request error message came.



Thanks,
Sairam

On Nov 9, 10:26 pm, Sachin Shenoy <therealsac...@gmail.com> wrote:
> Hi Carlos,
>

> You need to get 3-legged oauth consumer key / secret. Please follow
> instructions from the below URL.
>

> http://code.google.com/apis/accounts/docs/RegistrationForWebAppsAuto....

>
> The one you are using will only allow you to make 2-legged oauth calls.
>
> Regards,

> <http://code.google.com/apis/accounts/docs/RegistrationForWebAppsAuto....>
> Sachin

>
> On Fri, Nov 6, 2009 at 2:43 AM, los <carlo...@gmail.com> wrote:
>
> > Hi Sachin,
>
> > Thanks for the feedback.  That playground is a nice tool to know
> > about.
>
> > So I followed your instructions like this:
>

> > 1. On panel 1 I enteredhttp://sandbox.orkut.gmodules.com/social/rpc

> > (I corrected the spelling mistake on the word "social")
> > 2. On panel 2 I set oauth_signature_method to HMAC-SHA1
> > 3  Set oauth_consumer_key to orkut.com:121212121212   (I am using
> > 121212... as an example, I set the actual value in my test)
> > 4. Set consumer secret to abcdefabcedfabcdef (Again abcdef... is just
> > an example I set my correct secret in the test)
> > 5. clicked Request token on panel 3
>
> > I got a 400 response, with the result of "Consumer is not registered:
> > orkut.com:121212121212"
>
> > So now I'm thinking that just because I have a consumer key and secret
> > it doesn't necessarily mean I can make requests to that provider?
>
> > All I did to get the key & secret was create a hello world
> > mygadget.xml file and uploaded it to app engine.  Then went to

> >https://www.google.com/gadgets/directory/verifyand entered the url of

[sairam]

hi ,

I am trying to access the api provided by orkut using oauth
playground tool similar to what carlos has done.
I went through the link which was sent by you and we followed the
steps using our own domain... the thing upto which we can do is we can
able to get consumer key and consumer secret and the place where we
stuck now is

while managing our domain i came accross a step where it asks for
target url path prefix. i provided http://mydomain/authsub (here my
domain indicates our registed domain). i saved that and tried testing
authsub registration through the link provided .

but grant access failed with the following error mess:
Not Found
The requested URL /authsub was not found on this server.

But still I was able to succeed in oauth playground by selecting
google base in step1 and got the response for step 6.
Again when I tried to get request token by selecting orkut in step1,
by providing the consumer key, secret the following error
message :HTTP/1.1 400 Bad Request error message came.



Thanks,
Sairam

> > >https://www.google.com/gadgets/directory/verifyandentered the url of

[los]

Sachin,

Just one more question which I forgot to ask on my last reply.

Now that I have the 3-legged authentication working on the playground
with the sandbox orkut url you provided and the new consumer/secret
keys I got after correctly registering my application, how do I get my
code to work if the opensocial java client doesn't have the request
token, authorize and access urls defined in the provider?

Like I mentioned on my first post, the requestTokenUrl, authorizeUrl,
and accessTokenUrl are all defined to null for Orkut and OrkutSandbox
providers. I guess I could download the source, and hack those
providers so that they set:

requestTokenUrl = "https://www.google.com/accounts/
OAuthGetRequestToken";
authorizeUrl = "https://www.google.com/accounts/OAuthAuthorizeToken";
accessTokenUrl = "https://www.google.com/accounts/
OAuthGetAccessToken";

when those providers are initialized. I guess in summary my question
is: How are we supposed to do 3-legged authentication when the
providers are defined without the urls necessary to do the 3-legged
authentication?

Thanks,

-Carlos

> > >https://www.google.com/gadgets/directory/verifyandentered the url of

[Sudhakar]

hi,

I am able to use sandbox environment to under stand how oAuth is
working.

Now I want to use real development using ORKUT as provider.

OpenSocialProvider provider = OpenSocialProvider.valueOf("ORKUT");

final OpenSocialClient client = new OpenSocialClient
(provider);

String consumerKey = "Mykey";
String secretKey="MySerretkey";



client.setProperty
(OpenSocialClient.Property.CONSUMER_SECRET, secretKey);
client.setProperty(OpenSocialClient.Property.CONSUMER_KEY,
consumerKey);

Token token = OpenSocialOAuthClient.getRequestToken
(client, provider);

session.setAttribute("token_secret", token.secret);

String AUTH_CALLBACK = "http://xxx.xxx.xxx.xxx/Orkut";


String url = OpenSocialOAuthClient.getAuthorizationUrl
(provider, token, AUTH_CALLBACK);
but here i am getting Url as "null?oauth_callback=http://
xxx.xxx.xxx.xxx/Orkut".

Please advise how i can redirect to get requesttoken authenticated.

thanks,
Sudhakar

On Nov 10, 4:15 am, los <carlo...@gmail.com> wrote:

> > >https://www.google.com/gadgets/directory/verifyandentered the url of

> > > > > (OpenSocialOAuthClient.java:170)- Hide quoted text -
>
> - Show quoted text -

[sairam]

hi ,
I am trying to access the api provided by orkut using oauth
playground tool similar to what carlos has done.
I went through the link which was sent by you and we followed the
steps using our own domain... the thing upto which we can do is we can
able to get consumer key and consumer secret and the place where we
stuck now is

while managing our domain i came accross a step where it asks for
target url path prefix. i provided http://mydomain/authsub (here my
domain indicates our registed domain). i saved that and tried testing
authsub registration through the link provided .

but grant access failed with the following error mess:
Not Found
The requested URL /authsub was not found on this server.

But still I was able to succeed in oauth playground by selecting
google base in step1 and got the response for step 6.
Again when I tried to get request token by selecting orkut in step1,
by providing the consumer key, secret the following error
message :HTTP/1.1 400 Bad Request error message came.



Thanks,
Sairam

On Nov 9, 10:26 pm, Sachin Shenoy <therealsac...@gmail.com> wrote:
> Hi Carlos,
>

> You need to get 3-legged oauth consumer key / secret. Please follow
> instructions from the below URL.
>

> http://code.google.com/apis/accounts/docs/RegistrationForWebAppsAuto....

>
> The one you are using will only allow you to make 2-legged oauth calls.
>
> Regards,

> <http://code.google.com/apis/accounts/docs/RegistrationForWebAppsAuto....>
> Sachin

>
> On Fri, Nov 6, 2009 at 2:43 AM, los <carlo...@gmail.com> wrote:
>
> > Hi Sachin,
>
> > Thanks for the feedback.  That playground is a nice tool to know
> > about.
>
> > So I followed your instructions like this:
>

> > 1. On panel 1 I enteredhttp://sandbox.orkut.gmodules.com/social/rpc

> > (I corrected the spelling mistake on the word "social")
> > 2. On panel 2 I set oauth_signature_method to HMAC-SHA1
> > 3  Set oauth_consumer_key to orkut.com:121212121212   (I am using
> > 121212... as an example, I set the actual value in my test)
> > 4. Set consumer secret to abcdefabcedfabcdef (Again abcdef... is just
> > an example I set my correct secret in the test)
> > 5. clicked Request token on panel 3
>
> > I got a 400 response, with the result of "Consumer is not registered:
> > orkut.com:121212121212"
>
> > So now I'm thinking that just because I have a consumer key and secret
> > it doesn't necessarily mean I can make requests to that provider?
>
> > All I did to get the key & secret was create a hello world
> > mygadget.xml file and uploaded it to app engine.  Then went to

> >https://www.google.com/gadgets/directory/verifyand entered the url of

[Sachin Shenoy]

Hi Sairam,

Please don't select "orkut" in step 1. Please read my earlier mail on what to do at that step.

Sachin

[Sachin Shenoy]

Hi Sudhakar,

It is not clear if yours is an installed app or a web app? Looks like a web app, in any case

For installed app read this http://code.google.com/apis/accounts/docs/OAuthForInstalledApps.html
For web app read this http://code.google.com/apis/accounts/docs/OAuth.html

In general here is the oauth api reference for google http://code.google.com/apis/accounts/docs/OAuth_ref.html

Note that while making call to https://www.google.com/accounts/OAuthGetRequestToken for getting a request token, you have to provide "scope" param. This is required param and is google specific extension. The scope for orkut sandbox is "http://sandbox.orkut.gmodules.com/social/rpc".

Thanks,
Sachin

[los]

Hi Sachin,

I think Sudhakar is touching on the same topic that I was.

I understand what you're saying about making the call to
https://www.google.com/accounts/OAuthGetRequestToken, but what we're
saying is that the java client provided to make that request does not
have that url configured in the provider class. It's set to null, and
that's why the url is null?oauth_callback=xxxx. It seems like the
java client was built to use the Orkut provider for 2-legged
authentication only, but we're trying to do 3-legged.

If that's the case then it's fine, I just would like confirmation that
I need to write my own code to do the steps listed in the
documentation and in the oauth playground.

Thanks again!

On Nov 12, 2:26 am, Sachin Shenoy <therealsac...@gmail.com> wrote:
> Hi Sudhakar,
>
> It is not clear if yours is an installed app or a web app? Looks like a web
> app, in any case
>

> For installed app read thishttp://code.google.com/apis/accounts/docs/OAuthForInstalledApps.html
> For web app read thishttp://code.google.com/apis/accounts/docs/OAuth.html
>
> In general here is the oauth api reference for googlehttp://code.google.com/apis/accounts/docs/OAuth_ref.html
>
> Note that while making call tohttps://www.google.com/accounts/OAuthGetRequestTokenfor getting a request

> > > > >https://www.google.com/gadgets/directory/verifyandenteredthe url of

[paola]

As for configuring the URL for 3-legged OAuth in the
OpenSocialProvider in the Java library I've found a work around that
turn it into a 3-legged open social provider.
Please check if this code sounds good

p = OpenSocialProvider.valueOf("ORKUT_SANDBOX");
// override values in order to turn it into a 3-legged provider
p.requestTokenUrl = "https://www.google.com/accounts/
OAuthGetRequestToken";
p.authorizeUrl = "https://www.google.com/accounts/
OAuthAuthorizeToken";
p.accessTokenUrl = "https://www.google.com/accounts/
OAuthGetAccessToken";
p.restEndpoint = "http://sandbox.orkut.gmodules.com/social/rest";
p.rpcEndpoint = "http://sandbox.orkut.gmodules.com/social/rpc";
p.requestTokenParams = new HashMap<String, String>();
p.requestTokenParams.put("scope","http://sandbox.orkut.gmodules.com/
social/rest/people");

Using this trick I could successfully obtain an access token from my
application BUT when I try to load either /people/@me/@self or /people/
@me/@friends for the user that has granted access I get a 403 response
(either "Get profile permission denied." or "Friend permission not
granted").
And the same happens in the OAuth playground application.

Any idea?

thanks
Paola

On Nov 18, 2:58 am, los <carlo...@gmail.com> wrote:
> Hi Sachin,
>

> I think Sudhakar is touching on the same topic that I was.
>

> I understand what you're saying about making the call tohttps://www.google.com/accounts/OAuthGetRequestToken, but what we're

> saying is that the java client provided to make that request does not
> have that url configured in the provider class.  It's set to null, and
> that's why the url is null?oauth_callback=xxxx.  It seems like the
> java client was built to use the Orkut provider for 2-legged
> authentication only, but we're trying to do 3-legged.
>
> If that's the case then it's fine, I just would like confirmation that
> I need to write my own code to do the steps listed in the
> documentation and in the oauth playground.
>
> Thanks again!
>
> On Nov 12, 2:26 am, Sachin Shenoy <therealsac...@gmail.com> wrote:
>
> > Hi Sudhakar,
>
> > It is not clear if yours is an installed app or a web app? Looks like a web
> > app, in any case
>
> > For installed app read thishttp://code.google.com/apis/accounts/docs/OAuthForInstalledApps.html
> > For web app read thishttp://code.google.com/apis/accounts/docs/OAuth.html
>
> > In general here is the oauth api reference for googlehttp://code.google.com/apis/accounts/docs/OAuth_ref.html
>

> > Note that while making call tohttps://www.google.com/accounts/OAuthGetRequestTokenforgetting a request

> > > > > >https://www.google.com/gadgets/directory/verifyandenteredtheurl of

> ...
>
> read more »