How to get Access Token in java using OAuth 1.0?

Question

Requirement: I want to access resources reside in cloud application.

This cloud application provided me following details to access resources through OAuth 1.0 authentication.

OAuth Credentials

Consumer Key
Consumer Secret

OAuth Request URLs

1. Request Token URL
2. Authorise URL
3. Access Token URL
4. API Endpoint URL

I have wrote following java code to get Request Token and Request Token Secret . I store Request Token and Secret in property file for retrieving Access Token.

OAuthAccessor accessor = createOAuthAccessor();
            OAuthClient client = new OAuthClient(new HttpClient4());
                client.getRequestToken(accessor);

 props.setProperty("requestToken", accessor.requestToken);
                props.setProperty("tokenSecret", accessor.tokenSecret);


 private OAuthAccessor createOAuthAccessor(){
        String consumerKey = props.getProperty("consumerKey");
        String callbackUrl = null;
        String consumerSecret = props.getProperty("consumerSecret");

        String reqUrl = props.getProperty("requestUrl");
        String authzUrl = props.getProperty("authorizationUrl");
        String accessUrl = props.getProperty("accessUrl");

        OAuthServiceProvider provider
                = new OAuthServiceProvider(reqUrl, authzUrl, accessUrl);
        OAuthConsumer consumer
                = new OAuthConsumer(callbackUrl, consumerKey,
                consumerSecret, provider);
        return new OAuthAccessor(consumer);
    }

Property file details:

requestToken= generated by service provider
authorizationUrl= Authorise URL provided by cloud application
consumerSecret= Consumer Secret provided by cloud application
accessUrl=Access Token URL provided by cloud application
tokenSecret= generated by service provider
requestUrl= Request Token URL provided by cloud application
consumerKey= Consumer Secret provided by cloud application
appName= API Endpoint URL provided by cloud application

I am able to retrieve Request Token and Request Token Secrete from Service Provider with Request Token URL provided by cloud application.

Then I used generated Request Token and Request Token Secrete to get Access Token by using following code

OAuthAccessor accessor = createOAuthAccessor();
accessor.tokenSecret = props.getProperty("tokenSecret");
OAuthClient client = new OAuthClient(new HttpClient4());
return client.invoke(accessor, "GET",  url, params);

After executing above code for retrieving Access token I got following exception

If I pass API Endpoint URL /Resource as value of URL parameter to client.invoke() in above code then I am getting following exception

> <<<<<<<< HTTP response: HTTP/1.1 401 Unauthorized Cache-Control:
> private Content-Type: text/html; charset=utf-8 WWW-Authenticate: OAuth
> Realm="115.248.52.162" X-S: 445759-O1VMAP02 Strict-Transport-Security:
> max-age=31536000 Date: Tue, 18 Jun 2013 06:59:28 GMT Content-Length:
> 142
> 
> Exception in thread "main" net.oauth.OAuthProblemException:
> token_rejected oauth_problem_advice: Token RZXHZYCCUMNMZA88032WJFB
> does not match an expected ACCESS token

And if I pass Access Token URL as value of URL parameter in client.invoke() then I am getting following exception

> <<<<<<<< HTTP response: HTTP/1.1 401 Unauthorized Cache-Control:
> private Content-Type: text/html; charset=utf-8 WWW-Authenticate: OAuth
> Realm="49.248.38.202" X-S: 445758-O1VMAP01 Strict-Transport-Security:
> max-age=31536000 Date: Tue, 18 Jun 2013 05:47:30 GMT Content-Length:
> 115
> 
> oauth_problem=permission_denied&oauth_problem_advice=The%20consumer%20was%20denied%20access%20to%20this%20resource.

Questions:

Which URL Should I use to get Access Token?
Am I missing any step or setting to retrieve Access token?

Thanks in Advance.

ikumen ikumen · Accepted Answer · 2013-06-18T13:27:38

Without seeing your cloud api documentation, I can only assume they follow the typical oauth dance for authentication - which is:

you get request token from provider (request token url)
using request token, form an auth url (usually points to provider)
redirect user to auth url (authorize url)
user authenticates/authorizes
provider does callback back to you with verifier
using verifier and request token, you exchange for access token (access token url)
now you can use your access token to access the api

So unless you're missing some of these steps, some other things to look at are: correctly signing request, using correct urls for each step, passing correct token at each step.

Also, the request token/secret is usually short lived, while the access token is "usually" much longer and in most cases/systems can be used with multiple api request.

How to get Access Token in java using OAuth 1.0?

2 Answers