CXF OAuth 1.0 extension

CXF OAuth 1.0 extension has been build during Google Summer of Code 2010 programme. It implements specification: The OAuth 1.0 protocol (RFC 5849)  and allows CXF users to build OAuth server

and perform OAuth 1.0 authorization on their JAXRS services in a easy manner, by hiding complex OAuth flow. 

Downloading CXF OAuth 1.0 module">Downloading CXF OAuth 1.0 module

OAuth Server basic configuration

CXF, provides implementation for three endpoints from OAuth 1.0 specification:

• Temporary Credentials Endpoint
• Authorization Endpoint
• Token Credentials Endpoint

which are usual JAX-RS resources. They allow client application to receive access token from the server required to access resources at that server.

Configuration is exatcly this same as for every JAX-RS service:

<!-- Publish OAuth endpoints-->
    <jaxrs:server id="oauthServer" address="/oauth/">
        <jaxrs:serviceBeans>
            <ref bean="oauthServices"/>
        </jaxrs:serviceBeans>
        <jaxrs:providers>
            <ref bean="dispatchProvider"/>
        </jaxrs:providers>
    </jaxrs:server>

    <!--Definitions of OAuth module endpoints-->
    <bean id="oauthServices"
          class="org.apache.cxf.auth.oauth.endpoints.OAuthDefaultServices">
        <property name="displayVerifierURL" value="http://www.example.com/app/displayVerifier"/>
    </bean>

    <!--Redirects from Resource Owner Authorization Endpoint to sign in page-->
    <bean id="dispatchProvider">
        <property name="resourcePath" value="/oAuthLogin.jsp"/>
    </bean>

OAuth Server requires to save and read an OAuth data (OAuth tokens, oauth_verifier, client identifier ...) from the persistence storage specific for the particural web application. 

To make that transparent to the developers, CXF uses:

org.apache.cxf.auth.oauth.provider.OAuthDataProvider

interface as an integration point between llibrary and the application. There is provided sample implementation of that interface that manages data stored in the memory:

org.apache.cxf.auth.oauth.provider.MemoryOauthDataProvider

that is located in core OAuth module and 

org.apache.cxf.auth.oauth.demo.server.oauth.SampleOAuthDataProvider

in OAuth demo server module.

OAuth Endpoints explained

Temporary Credentials

Client sends oauth required parameters in order to receive temporary request token. CXF handles request, validates it, reads required information about the client and

save state(request token returned to the client in the response) required in the next OAuth request. CXF returns OAuth 1.0a specification compliant response.

Resource Owner Authorization

To assure more flexible authorization and access control to the server resources there were added two custom parameters:

• x_oauth_scope - specifies comma separated server uri's to which client wants to have access
• x_oauth_permission - specifies comma separated list of permissions to x_oauth_scope uri's which client wants to have

i.e.:
After granting permissions by the user to server resources, CXF saves this data that will be required in later access control evaluation, generates oauth_verifier and returns it to the client.

Examplar screen where server user allows/denies access for a third party application

Location of above confirmation screen can be configured by registering dispatch provider as shown in OAuth Server basic configuration.CXF return OAuth compliant errors in case of wrong client requests. 

Token Credentials

Token Credentials Endpoint
Client sends request to the Authorization Server in order to exchange previously received oauth_verifier on access token. Similarly in this step CXF handles request and return suitable response.
If the request is correct client receives an OAuth access token.
Access token give the rights to the user on the particular client to access previously authorized scopes with associated permissions.
Client need to attach access token with every request to oauth protected resource.