Page History

h1. CXF OAuth 1.0 extension

CXF OAuth 1.0 extension has been build during Google Summer of Code 2010 programme. It implements specification: [The OAuth 1.0 protocol (RFC 5849)|http://tools.ietf.org/html/rfc5849]  and allows CXF users to build OAuth server

and perform OAuth 1.0 authorization on their JAXRS services in a easy manner, by hiding complex OAuth flow. 

h3. {color:#003366}{*}Downloading CXF OAuth 1.0 module{*}{color}

{TBD}

h3. OAuth Server basic configuration

Basic OAuth flowCXF, provides implementation for three OAuth authorization endpoints:
\-* *Temporary Credentials Endpoint*
\-* *Authorization Endpoint*
\-* *Token Credentials Endpoint*

which are usual JAX-RS resources.

Configuration is exatcly this same as for every JAX-RS service:

{code}
{

}
CXF, provides implementation for three OAuth authorization endpoints:
* Temporary Credentials Endpoint
* Authorization Endpoint
* Token Credentials Endpoint

which are usual JAX-RS resources.

Configuration is exatcly this same as for every JAX-RS service:

{code}
{

}
{code}{code}OAuth Server requires to save and read an OAuth data (OAuth tokens, oauth_verifier, client identifier ...) from the persistence storage specific for the particural web application. 
To make that transparent to the developers, CXF uses:

{code}
{}
{code}
interface as an integration point between llibrary and the application. There is provided sample implementation of that interface that manages data stored in the memory:


{code}
{}
{code}

h2. *OAuth Endpoints explained*

h5. Temporary Credentials Endpoint

Client sends oauth required parameters in order to receive temporary request token. CXF handles request, validates it, reads required information about the client and

save state(request token returned to the client in the response) required in the next OAuth request. CXF returns OAuth 1.0a specification compliant response.

h5. Authorization Endpoint

To assure more flexible authorization and access control to the server resources there were added two custom parameters:
* *x_oauth_scope* \- specifies comma separated server uri's to which client wants to have access
* *x_oauth_permission* \- specifies comma separated list of permissions to x_oauth_scope uri's which client wants to have

i.e.:
After granting permissions by the user to server resources, CXF saves this data that will be required in later access control evaluation, generates oauth_verifier and returns it to the client.

CXF return OAuth compliant errors in case of wrong client requests 


{screen}


h5. Token Credentials Endpoint

Token Credentials Endpoint
Client sends request to the Authorization Server in order to exchange previously received oauth_verifier on access token. Similarly in this step CXF handles request and return suitable response.
If the request is correct client receives an OAuth access token.
Access token give the rights to the user on the particular client to access previously authorized scopes with associated permissions.
Client need to attach access token with every request to oauth protected resource.