使用Oauth2.0在Spring MVC中进行灵活身份验证的库

Question

EDIT:

I'm doing this for the first time and I don't know what to choose for my case. I've got a Spring MVC project set up on my server(it's just a single page web app) and would like to add some "custom API calls" so that my users can access their data on behalf of my app .

Examples (Imagine a blank page where a user added his preferred links in his listBox ):

facebook.com/get_my_latest_posts gym.com/pay_my_membership butcher.com/buy_2kg_beef

The user can edit/add links anytime he wants. When he clicks a link , the link is being called and the user receives his facebook latest posts , confirmation that the gym membership has been paid or confirmation that he bought 2kg of beef . (a result based on what link was called)

I wouldn't want to bring the user always a login page, so I'll try to use an access token where possible.

Does this sound like science fiction ?

If it doesn't, then I saw the spring social examples but wouldn't be better if I used a library like google's OAUTH library or Apache Oltu ?

Answer 1

Spring Social, Google's OAuth Client Library for Java and Apache Oltu fulfill the oauth specification and are all good candidates. Every library comes with some predefined providers. Spring Social and Apache Oltu contains some popular platforms like Facebook, Twitter, Github or Google. Google OAuth Client Library for Java comes along with the Google API Client Library for Java in order to connect to Google services. In Spring Social and Google OAuth Client Library those providers are optional.

All three libraries are written in a generic way so that one can connect to any oauth provider. I think that Spring Social could require less integration work than Apache Oltu or Google OAuth Client Library in regard to other Spring modules like Spring Security or MVC. In the end it all boils down to your personal preference for a library.

If you decide for Spring Social, take a look at this quickstart demo (ignore the README.md and just run ./gradlew bootRun ). It already contains everything you described in the comments of your question:

• authenticate user through a third party
• integrate several platforms in one application and fetch user data on demand (imagine the dropdown menu items for example Twitter profile or Timeline represents facebook.com/get_my_latest_posts or gym.com/pay_my_membership )

As you can see in the demo, you can't prevent that your users have to authenticate with every third party once in a time. This happens usually when there is no access or refresh token or the token has expired.

Take a look at the Spring Social documentation on how to add a new service provider.

Summary

All three libraries are extensible and fit your needs. There are many examples on the internet for every library. Spring Social could require less integration work into an existing Spring application.

Your application is just a host for many oauth clients for different services (so no science fiction here). You'll need to think about storing the access and refresh token on a per user basis somewhere (database?). You'll need to provide an after authorization callback url in your application for every service you want to integrate.

Answer 2

Defiantly friend.

You should try implementing token service to access your web-application.

It is the best way and considered as a good practice.

Please try configuring your own oAuth server using your google account.

Below link has good explanation how we can do that.

https://oneminutedistraction.wordpress.com/2014/04/29/using-oauth-for-your-javaee-login/

Another example. Below one is also a good example for beginners.

https://stormpath.com/blog/token-auth-for-java