Ryan Heaton's Blog

Ryan Heaton is a senior software engineer for FamilySearch.org. Ryan specializes in the design and development of Web services, particularly for the Java platform. He actively contributes to the effort of making Web services easy to develop and publish while maintaining an acceptable level of interoperability. As part of his contribution to this end, Ryan engineered Enunciate, a Web service deployment framework. Ryan is the father of four boys and currently resides in Salt Lake City.

OAuth is Handy

OAuth for Spring Security was released this week, and I thought I'd take a stab at why you might be interested.

What is OAuth?

I like to explain OAuth by describing the problem it is trying to solve. So here goes.

Let's say you're a sizeable social networking site and you'd like to offer a feature to your users to allow them to search their webmail contacts for import into their social network. The problem is, you (the "consumer") need access to a resource that is protected by a another site (a.k.a. "service provider"). How do you go about doing that?

Option 1: Just ask the user for his/her credentials and promise that you won't store them or do anything bad with them. Well, it works, I suppose, but this isn't a great general-purpose practice for online applications. And it's not hard to see why. Sure, you might be trustworthy, but there are plenty of other sites who are not. And what about the service provider? How would you feel about your users giving out their credentials to other sites that want access to the resources you protect?

Option 2: Use OAuth. OAuth is a protocol that was defined to address this problem. Continuing the above example, let's say that you've established a trust with the webmail service providers. You share a "secret" (which in practical terms is a passphrase or a public key or something) that you can use to gain access to the webmail contacts—provided, of course, that the user approves it. In order to gain this approval, all you have to do is redirect the user to the login page of the webmail service provider and have the user tell the service provider that it's okay that you access his/her contacts.

OAuth is a protocol standard that can be used to enable this mechanism.

How do I try it out?

OAuth for Spring Security has a really nice tutorial that walks you through setting up both a service provider and a consumer on your local box. Once those are set up, you can see OAuth in action by walking through the user flow.

How do learn more?

• OAuth
• Spec
• FAQ
• Getting Started
• Illustration (Eran Hammer-Lahav)
• Presentation (Leah Culver)

Enunciate 1.7: Security and Custom Content Types

Enunciate 1.7 has been released!

The primary feature of Enunciate 1.7 is support for securing your Web service endpoints using Spring Security. There is additional support for OAuth, with OpenID and WS-Security planned for 1.8.

In addition, Enunciate 1.7 introduces the concept of custom REST content types, which you can use to support custom serialization formats for REST responses (beyond the default XML and JSON endpoints).

Enjoy!

http://enunciate.codehaus.org

June 2008

Search this blog:

Categories

Archives

May 2008
January 2008
October 2007
September 2007
August 2007
May 2007
April 2007

Recent Entries

OAuth is Handy

Enunciate 1.7: Security and Custom Content Types

Web Service Programming for the Masses, Part II: Developing the RIA

This work is licensed under a Creative Commons License.