Library for generating HMAC-SHA1 OAuth signature on Android?

Question

Using the specifications below I need to create an oauth_signature on Android. I'm looking for a library that handles the boiler plate code in creating a signature for accessing resources via OAuth.

Construct a signature "base string", which consists of a concatenation of three request elements:

The HTTP request method.

The base URL the request is being sent to. This URL should not include any query parameters. When signing calls to Google services, refer to the OAuth specification, Section 9.1.2, for relevant instructions.

A normalized string of the parameters in the request (excluding the oauth_signature parameter). This includes parameters sent in the request header or body, as well as query parameters added to the request URL. To normalize the string, sort the parameters using lexicographical byte value ordering. For more details on normalizing this string, see Section 9.1.1 of the OAuth specification.

Generate an oauth_signature using one of the following sequences:

If your application is registered and you're using HMAC-SHA1, use the OAuth "consumer secret" value generated during registration; this value is displayed on your domain's registration page.

DEzra · Answer 1 · 2013-12-16T22:06:07.087

11

In answer to Will's question on Chris's answer, you could use the built in android javax.crypto.mac to generate the hmacsha1 signature using following code (standard Java JCE provider apis):

Mac mac = Mac.getInstance("HmacSHA1");
SecretKeySpec secret = new SecretKeySpec(key.getBytes(), mac.getAlgorithm());
mac.init(secret);
byte[] digest = mac.doFinal(baseString.getBytes());
byte[] result=Base64.encode(digest, DEFAULT);

Where 'secret' would be you text you wanted to encode and 'result' above would be your hash encoded signature.

edited Dec 16 '13 at 22:06

answered Dec 31 '11 at 23:44

DEzra

2,978
5
31
50

1

`Base64.encodeBase64()` is from Apache's package which doesn't exist in android. Instead, `Base64.encode(string,flag)` should be used. – Mahm00d Nov 28 '13 at 14:12
thanx @Mahm00d, i have updated my answer. I have also set the flag param to DEFAULT to get the default encode settings (http://developer.android.com/reference/android/util/Base64.html) – DEzra Dec 16 '13 at 22:09

score 1 · Answer 2 · answered Sep 06 '15 at 08:58

1

Here is the code i used, just pass the value and key to the hmacSha1().. it returns hmacsha1 string;

private static String hmacSha1(String value, String key)
            throws UnsupportedEncodingException, NoSuchAlgorithmException,
            InvalidKeyException {
        String type = "HmacSHA1";
        SecretKeySpec secret = new SecretKeySpec(key.getBytes(), type);
        Mac mac = Mac.getInstance(type);
        mac.init(secret);
        byte[] bytes = mac.doFinal(value.getBytes());
        return bytesToHex(bytes);
    }

    private final static char[] hexArray = "0123456789abcdef".toCharArray();

    private static String bytesToHex(byte[] bytes) {
        char[] hexChars = new char[bytes.length * 2];
        int v;
        for (int j = 0; j < bytes.length; j++) {
            v = bytes[j] & 0xFF;
            hexChars[j * 2] = hexArray[v >>> 4];
            hexChars[j * 2 + 1] = hexArray[v & 0x0F];
        }
        return new String(hexChars);
    }

answered Sep 06 '15 at 08:58

Muneef M

1,094
15
17

what are the parameters? value and key? – Subin Babu Mar 27 '18 at 08:00
@SubinBabu . inorder to create a hmacsha1 you need to provide two params a key and a message, the value of these two will depend on your use case. – Muneef M Mar 27 '18 at 09:45
For Magento API what we pass in server side it is Consumer Secret and Token Secret – Subin Babu Mar 27 '18 at 09:52
For Oauth i dont think you should be passing CS and TS . You need to concatenate a set of URL-encoded attributes and parameters to construct the signature base string. please refer - http://devdocs.magento.com/guides/v2.0/get-started/authentication/gs-authentication-oauth.html#oauth-signature – Muneef M Mar 27 '18 at 10:22

score 1 · Answer 3 · answered May 13 '11 at 21:32

1

I don't know anything about OAuth, but you can use javax.crypto.Mac to generate HMAC-SHA1 value (use HmacSHA1 as the algorithm name):

Mac hmac = Mac.getInstance("HmacSHA1");

answered May 13 '11 at 21:32

C. K. Young

219,335
46
382
435

And how is that Object used to create a signature? It doesn't seem clear in the documentation. – Will Curran May 13 '11 at 21:39

score 0 · Accepted Answer · answered May 13 '11 at 21:37

0

I've used this library for an Android OAuth Client: http://code.google.com/p/oauth-signpost/

answered May 13 '11 at 21:37

andrewmitchell

1,559
13
15

Just did some testing and while not ideal for accessing GAE endpoints, it works! Thanks. – Will Curran May 14 '11 at 01:25
@WillMerydith But this can't be used for .net or LinkedIn api – ManishSB Apr 23 '15 at 11:37

Library for generating HMAC-SHA1 OAuth signature on Android?

4 Answers4