OAuth - JAX-RS - Setting up secure webpage

Question

I'm having a JAX-RS project, I need to secure 1 specific page with OAuth, if possible I would like to have everything in 1 class.

There seems to be no fitting guide or tutorial on what I searched.

Here's what I've tried so far:

Original class:

 @Path("/topsecret")
 @Produces(MediaType.TEXT_PLAIN)
 public class TopSecretRestService extends AbstractRestService {

  @GET
  @Path("/")
   public Response getSecret() {
       String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
       return Response.status(200).entity(output).build();

   }
}

Steeplesoft's solution: (keeps giving errors on everything)

@Path("/topsecret")
@Produces(MediaType.TEXT_PLAIN)
public class TopSecretRestService extends AbstractRestService {

    @Path("/")
    @GET
    public Response authorize(@Context HttpServletRequest request)
            throws URISyntaxException, OAuthSystemException {
        try {
            OAuthAuthzRequest oauthRequest =
                new OAuthAuthzRequest(request);
            OAuthIssuerImpl oauthIssuerImpl =
                new OAuthIssuerImpl(new MD5Generator());

            //build response according to response_type
            String responseType =
                oauthRequest.getParam(OAuth.OAUTH_RESPONSE_TYPE);

            OAuthASResponse.OAuthAuthorizationResponseBuilder builder =
                    OAuthASResponse.authorizationResponse(request,
                        HttpServletResponse.SC_FOUND);

            // 1
            if (responseType.equals(ResponseType.CODE.toString())) {
                final String authorizationCode =
                    oauthIssuerImpl.authorizationCode();
                database.addAuthCode(authorizationCode);
                builder.setCode(authorizationCode);
            }

            String redirectURI =
                oauthRequest.getParam(OAuth.OAUTH_REDIRECT_URI);
            final OAuthResponse response = builder
                .location(redirectURI)
                .buildQueryMessage();
            URI url = new URI(response.getLocationUri());
            return Response.status(response.getResponseStatus())
                .location(url)
                .build();

            String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
            return Response.status(200).entity(output).build();


        } catch (OAuthProblemException e) {
            // ...
        }
}

}

Google's solution (seems easiest but cannot find the fitting jar's)

@GET
@Path("/")
public Response getSecret() {

    OAuthService oauth = OAuthServiceFactory.getOAuthService();
    String scope = "https://www.googleapis.com/auth/userinfo.email";
    Set<String> allowedClients = new HashSet<>();
    allowedClients.add("407408718192.apps.googleusercontent.com"); // list your client ids here

    try {
      User user = oauth.getCurrentUser(scope);
      String tokenAudience = oauth.getClientId(scope);
      if (!allowedClients.contains(tokenAudience)) {
        throw new OAuthRequestException("audience of token '" + tokenAudience
            + "' is not in allowed list " + allowedClients);
      }
      // proceed with authenticated user
        String output = "This is TOP secret: " + configuration.getValue(Configuration.Key.TOPSECRET);
        return Response.status(200).entity(output).build();
    } catch (OAuthRequestException ex) {
      // handle auth error
      // ...
    } catch (OAuthServiceFailureException ex) {
      // optionally, handle an oauth service failure
      // ...
    }

}

Sites and other questions looked into:

Securing jax-rs with OAuth -- answer provided by asker, very short and no details

Jax RS REST API - OAuth 2.0 and Control Origin -- answer provided by asker, not the same problem

http://cxf.apache.org/docs/jax-rs-oauth2.html tutorial on jax-rs with oauth2

NOTE: I'm very new to both OAuth and jax-rs

score 1 · Accepted Answer · edited Oct 07 '21 at 11:19

The simplest working example written using JAX-RS is java-oauth-server. It is an authorization server implementation that supports not only OAuth 2.0 (RFC 6749 and others) but also OpenID Connect.

If you are looking for not an authorization server implementation but a resource server implementation, see java-resource-server.

An authorization server is a server that issues access tokens. A resource server is a server that refers to access tokens and returns requested data. These two servers are logically different things, but they can be implemented on one server if you wish. I could not figure out which server you want to implement.

^{The answerer is the author of java-oauth-server and java-resource-server.}

OAuth - JAX-RS - Setting up secure webpage

1 Answers1

Linked