Create a ClientCredentialsFlow class

[wonderfly]

From sh...@knewton.com on May 06, 2014 13:07:20

I have created a class ClientCredentialsFlow, which functions like AuthorizationCodeFlow, but for client credentials. Although the steps needed with authorization code are much more complicated, it is still useful to have a Flow class for client credentials authentication:

• Support for credentialStore and/or credentialDataStore
• A single authorize() call which checks the store, gets the token request, and generates a Credential
• Setting refresh listeners (although most client credentials implementations don't support a refresh token)

I copied much of the code from AuthorizationCodeFlow, as well as a few bits from AuthorizationCodeInstalledApp.authorize()

I have a clone shawn-google-oauth-java-client which contains the code. The commit is at https://code.google.com/r/shawn-google-oauth-java-client/source/detail?r=638eeedd237134ab1665c54992bbbbfb938791fc

Original issue: http://code.google.com/p/google-oauth-java-client/issues/detail?id=93

[ghost]

Hello,

Is there still a way to get our hands on the changes? Was it working fine enough for production use even if it had not made it’s way in the repo? I have not found the changes in Wonderfly repo clone but maybe I’m not looking at the right place?

I have been tasked to in integrate a oauth2 protected rest service in another Spring MVC proxy service and it does look more complex than I tought at first.

I have done some testing with google client and Spring oauth security and it looks like the handling of concurrency and token refresh has some problems on Spring side (or not implemented?).

Google client looked fine until I realised that client credential flow was not offered. I tought that it could be implemented but I’m missing experience / perspective to be able to evaluate the work that need to be done even if I have a better feeling and understanding after reading alot of docs and samples and trying to connect things together.

Would gladly use any exemple of an implementation or any pointer of other viable alternatives.

Eric

[ghost]

I was able to figure it out...

The simplest solution for me was to duplicate 2 existing classes and adjust them (mostly removing code).

I have created ClientCredentialFlow.java from existing flow and AuthorisationCodeService.java from AuthorizationCodeInstalledApp.java.

There would be a need to think it again to preserve compatibility while preventing uneeded duplication.