It was my understanding Jersey 2 only supported OAuth 2 client (no server implementation). That is in the docs. Hence why I went w/ the Oauth 1 route as the docs sstate that there is a server implementation. Is that in error?
“15.3.2. OAuth 2 Support
At the moment Jersey supports OAuth 2 only on the client side.”
As far as what the docs lack, from a new user perspective they do not show how to get a trivial webservice secured (via either 2 or 3 legged). The best they do is link to the Oauth specification -
http://tools.ietf.org/html/rfc5849
Which is great for understanding how OAuth works. But it is useless in helping me understand how Jersey implemented this in Jersey 2.
- Damian
From: Craig McClanahan [mailto:craigmcc_at_gmail.com]
Sent: Thursday, July 24, 2014 12:42 AM
To: users_at_jersey.java.net
Subject: [Jersey] Re: Two legged Oauth 1 server example
Is there something you need that the Jersey Security Docs[1] do not cover?
I will echo the advice of others, though ... if you are writing green field applications you should really be looking at OAuth 2 rather than OAuth 1.
Craig
[1]
https://jersey.java.net/documentation/latest/security.html
On Wed, Jul 23, 2014 at 12:49 PM, Sobieralski, Damian Michael <dsobiera_at_indiana.edu<mailto:dsobiera_at_indiana.edu>> wrote:
I'm new to Jersey. But so far I am loving it! I have implemented a very basic RESTful webservice using Jersey 2.10
I've reached a point where I need to secure my webservice in some fashion. Oauth 1 seems like a good choice at first glance. However, I don't need 3 legged. The consumers of my webservice are within my own company so a 2 legged approach will suffice.
However, I cannot for the life of me find an example of how to do this (2 or 3 legged). The docs do a really good job starting out explaining Oauth but sort of leave it as an exercise to the user to finish an implementation :(
https://jersey.java.net/documentation/latest/security.html#d0e10929
I don't see how to actually secure my java webservice class - the thing with:
@GET
@Produces( { MediaType.APPLICATION_JSON, MediaType.TEXT_XML, MediaType.TEXT_PLAIN, MediaType.TEXT_HTML })
nor do I see how to setup the /oauth starting path and using the consumer and secret keys. Is there an annotation that I use in my webservice methods to secure it? Or some check that I need to do at the start of my method to make sure a 2 legged oauth session has passed the mustard?
I thought I found this as an example but this doesn't seem to be complete for me to use it.
http://stackoverflow.com/questions/2795404/authentication-and-authorization-for-restfull-api-java-jersery
Will a kind soul offer a link to an example or preferably a trivial code/config example to give me a boost in the right direction in implementing a 2 legged server approach in Jersey 2?
Thanks!
- Damian