import net.oauth.server.OAuthServlet; //导入依赖的package包/类
@Override
public String authenticate(HttpServletRequest request) throws IOException, OAuthException,
    URISyntaxException {
  OAuthMessage message = OAuthServlet.getMessage(request, null);

  // Retrieve and set the user info with the OAuth parameters
  Map<UserInfoProperties, Object> oauthParams = new HashMap<UserInfoProperties, Object>();
  oauthParams.put(UserInfoProperties.EMAIL,
      urlDecode(message.getParameter("opensocial_viewer_id")));
  oauthParams.put(UserInfoProperties.VIEWER_ID,
      urlDecode(message.getParameter("opensocial_viewer_id")));
  oauthParams.put(UserInfoProperties.OWNER_EMAIL,
      urlDecode(message.getParameter("opensocial_owner_id")));
  oauthParams.put(UserInfoProperties.OWNER_ID,
      urlDecode(message.getParameter("opensocial_owner_id")));
  oauthParams.put(UserInfoProperties.APPLICATION_ID, message.getParameter("opensocial_app_id"));
  oauthParams.put(UserInfoProperties.APPLICATION_URL, message.getParameter("opensocial_app_url"));

  UserInfo userInfo = new HashMapBasedUserInfo(oauthParams);
  request.setAttribute(AbstractManagedCollectionAdapter.USER_INFO, userInfo);

  return message.getParameter("opensocial_viewer_id");
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
@Override
public void doGet(HttpServletRequest request, HttpServletResponse response)
        throws IOException, ServletException {
    
    try{
        OAuthMessage requestMessage = OAuthServlet.getMessage(request, null);
        
        OAuthAccessor accessor = SampleOAuthProvider.getAccessor(requestMessage);
       
        if (Boolean.TRUE.equals(accessor.getProperty("authorized"))) {
            // already authorized send the user back
            returnToConsumer(request, response, accessor);
        } else {
            sendToAuthorizePage(request, response, accessor);
        }
    
    } catch (Exception e){
        SampleOAuthProvider.handleException(e, request, response, true);
    }
    
    
    
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
@Override 
public void doPost(HttpServletRequest request, HttpServletResponse response) 
        throws IOException, ServletException{
    
    try{
        OAuthMessage requestMessage = OAuthServlet.getMessage(request, null);
        
        OAuthAccessor accessor = SampleOAuthProvider.getAccessor(requestMessage);
        
        String userId = request.getParameter("userId");
        if(userId == null){
            sendToAuthorizePage(request, response, accessor);
        }
        // set userId in accessor and mark it as authorized
        SampleOAuthProvider.markAsAuthorized(accessor, userId);
        
        returnToConsumer(request, response, accessor);
        
    } catch (Exception e){
        SampleOAuthProvider.handleException(e, request, response, true);
    }
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response)
        throws IOException, ServletException {
    try{
        OAuthMessage requestMessage = OAuthServlet.getMessage(request, null);
        OAuthAccessor accessor = SampleOAuthProvider.getAccessor(requestMessage);
        SampleOAuthProvider.VALIDATOR.validateMessage(requestMessage, accessor);
        String userId = (String) accessor.getProperty("user");
        
        response.setContentType("text/plain");
        PrintWriter out = response.getWriter();
        out.println("[Your UserId:" + userId + "]");
        for (Object item : request.getParameterMap().entrySet()) {
            Map.Entry parameter = (Map.Entry) item;
            String[] values = (String[]) parameter.getValue();
            for (String value : values) {
                out.println(parameter.getKey() + ": " + value);
            }
        }
        out.close();
        
    } catch (Exception e){
        SampleOAuthProvider.handleException(e, request, response, false);
    }
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
/**
 * The workaround for Moodle and Canvas OAuth.<br>
 * If we have a duplicate, and it came from Moodle, it's worth presuming a
 * different reality applies. Hopefully by version moodle-3 they'll have
 * fixed this. ext_lms for moodle 2.3, 2.4, 2.5 was literally "moodle-2".
 * Use startsWith in case future moodle 2.x has an extended string. Read:
 * Dodgical hax
 * 
 * @param request
 * @return
 */
@Override
protected OAuthMessage getOAuthMessage(HttpServletRequest request)
{
	boolean dupe = false;
	String extlms = request.getParameter(ExternalToolConstants.EXT_LMS);
	String product = request.getParameter(ExternalToolConstants.TOOL_CONSUMER_INFO_PRODUCT_FAMILY_CODE);

	Set<Entry<String, String[]>> params = request.getParameterMap().entrySet();
	Map<String, String> newParams = Maps.newHashMap();

	if( "canvas".equalsIgnoreCase(product)
		|| (extlms != null && extlms.startsWith("moodle-2") && "moodle".equalsIgnoreCase(product))
		//hack for canvas ContentItemPlacements
		|| (request.getParameter("lti_message_type") != null
			&& request.getParameter("lti_message_type").equals("ContentItemSelectionRequest")) )
	{
		for( Entry<String, String[]> p : params )
		{
			String[] values = p.getValue();
			if( values.length == 2 && Objects.equal(values[0], values[1]) )
			{
				dupe = true;
			}
			newParams.put(p.getKey(), values[0]);
		}

		if( dupe )
		{
			return new OAuthMessage(request.getMethod(), urlService.getUriForRequest(request, null).toString(),
				newParams.entrySet());
		}
	}

	return OAuthServlet.getMessage(request, urlService.getUriForRequest(request, null).toString());
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
protected Map getPayloadAsMap(HttpServletRequest request) {
	Map payload = new HashMap();
	for (Enumeration e = request.getParameterNames(); e.hasMoreElements(); ) {
		String key = (String)e.nextElement();
		payload.put(key, request.getParameter(key));
	}

	String requestURL = SakaiBLTIUtil.getOurServletPath(request);
	payload.put("oauth_message", OAuthServlet.getMessage(request, requestURL));
	payload.put("tool_id", 	request.getPathInfo());
	return payload;
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
private static void handleException(Exception e, HttpServletRequest request,
                                    HttpServletResponse response, boolean sendBody)
        throws IOException, ServletException {
    String realm = (request.isSecure()) ? "https://" : "http://";
    realm += request.getLocalName();
    OAuthServlet.handleException(response, e, realm, sendBody);
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
@Override
public String authenticate(HttpServletRequest request) throws IOException, OAuthException,
    URISyntaxException {

  OAuthMessage message = OAuthServlet.getMessage(request, null);
  String consumerKey = message.getConsumerKey();
  String signatureMethod = message.getSignatureMethod();
  OAuthConsumer consumer = keyManager.getOAuthConsumer(provider, consumerKey, signatureMethod);
  if (null == consumer) {
    logger.info("signed fetch verification failed: consumer is null");
    throw new OAuthException("Unauthorized");
  }
  OAuthAccessor accessor = new OAuthAccessor(consumer);
  message.validateMessage(accessor, validator);

  String viewerEmail = message.getParameter("opensocial_viewer_email");
  if (viewerEmail == null) {
    logger.info("signed fetch verification failed: viewer email is null");
    throw new OAuthException("Missing user identity opensocial_viewer_email");
  }

  // Retrieve and set the user info with the OAuth parameters
  Map<UserInfoProperties, Object> oauthParams = new HashMap<UserInfoProperties, Object>();
  oauthParams.put(UserInfoProperties.EMAIL, urlDecode(viewerEmail));
  oauthParams.put(UserInfoProperties.VIEWER_ID, message.getParameter("opensocial_viewer_id"));
  oauthParams.put(UserInfoProperties.OWNER_EMAIL,
      urlDecode(message.getParameter("opensocial_owner_email")));
  oauthParams.put(UserInfoProperties.OWNER_ID, message.getParameter("opensocial_owner_id"));
  oauthParams.put(UserInfoProperties.APPLICATION_ID, message.getParameter("opensocial_app_id"));
  oauthParams.put(UserInfoProperties.APPLICATION_URL, message.getParameter("opensocial_app_url"));

  UserInfo userInfo = new HashMapBasedUserInfo(oauthParams);
  request.setAttribute(AbstractManagedCollectionAdapter.USER_INFO, userInfo);

  logger.info("signed fetch verified: " + viewerEmail);
  return message.getParameter("opensocial_viewer_id");
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
public static void handleException(Exception e, HttpServletRequest request,
        HttpServletResponse response, boolean sendBody)
        throws IOException, ServletException {
    String realm = (request.isSecure())?"https://":"http://";
    realm += request.getLocalName();
    OAuthServlet.handleException(response, e, realm, sendBody); 
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
/** Reconstruct the requested URL path, complete with query string (if any). */
private static String getRequestPath(HttpServletRequest request)
        throws MalformedURLException {

    URL url = new URL(OAuthServlet.getRequestURL(request));
    StringBuilder path = new StringBuilder(url.getPath());
    String queryString = url.getQuery();
    if (queryString != null) {
        path.append("?").append(queryString);
    }
    return path.toString();
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
public void processRequest(HttpServletRequest request, HttpServletResponse response)
        throws IOException, ServletException {
    try{
        OAuthMessage requestMessage = OAuthServlet.getMessage(request, null);
        
        OAuthAccessor accessor = SampleOAuthProvider.getAccessor(requestMessage);
        SampleOAuthProvider.VALIDATOR.validateMessage(requestMessage, accessor);
        
        // make sure token is authorized
        if (!Boolean.TRUE.equals(accessor.getProperty("authorized"))) {
             OAuthProblemException problem = new OAuthProblemException("permission_denied");
            throw problem;
        }
        // generate access token and secret
        SampleOAuthProvider.generateAccessToken(accessor);
        
        response.setContentType("text/plain");
        OutputStream out = response.getOutputStream();
        OAuth.formEncode(OAuth.newList("oauth_token", accessor.accessToken,
                                       "oauth_token_secret", accessor.tokenSecret),
                         out);
        out.close();
        
    } catch (Exception e){
        SampleOAuthProvider.handleException(e, request, response, true);
    }
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
public void processRequest(HttpServletRequest request, HttpServletResponse response)
        throws IOException, ServletException {

    try {
        OAuthMessage requestMessage = OAuthServlet.getMessage(request, null);
        
        OAuthConsumer consumer = SampleOAuthProvider.getConsumer(requestMessage);
        
        OAuthAccessor accessor = new OAuthAccessor(consumer);
        SampleOAuthProvider.VALIDATOR.validateMessage(requestMessage, accessor);
        {
            // Support the 'Variable Accessor Secret' extension
            // described in http://oauth.pbwiki.com/AccessorSecret
            String secret = requestMessage.getParameter("oauth_accessor_secret");
            if (secret != null) {
                accessor.setProperty(OAuthConsumer.ACCESSOR_SECRET, secret);
            }
        }
        // generate request_token and secret
        SampleOAuthProvider.generateRequestToken(accessor);
        
        response.setContentType("text/plain");
        OutputStream out = response.getOutputStream();
        OAuth.formEncode(OAuth.newList("oauth_token", accessor.requestToken,
                                       "oauth_token_secret", accessor.tokenSecret),
                         out);
        out.close();
        
    } catch (Exception e){
        SampleOAuthProvider.handleException(e, request, response, true);
    }
    
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
private void readBody(Service service) {

    service.setMessage(OAuthServlet.getMessage(this.b2Context.getRequest(), null));
    try {
      this.response.setData(service.getMessage().readBodyAsString());
    } catch (IOException e) {
    }

  }
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
private void createAccessToken(HttpServletRequest servletRequest,
    HttpServletResponse servletResponse) throws ServletException, IOException, OAuthException, URISyntaxException {
  OAuthMessage requestMessage = OAuthServlet.getMessage(servletRequest, null);

  OAuthEntry entry = getValidatedEntry(requestMessage);
  if (entry == null)
    throw new OAuthProblemException(OAuth.Problems.TOKEN_REJECTED);

  if (entry.callbackToken != null) {
    // We're using the fixed protocol
    String clientCallbackToken = requestMessage.getParameter(OAuthConstants.OAUTH_VERIFIER);
    if (!entry.callbackToken.equals(clientCallbackToken)) {
      dataStore.disableToken(entry);
      servletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "This token is not authorized");
      return;
    }
  } else if (!entry.authorized) {
    // Old protocol.  Catch consumers trying to convert a token to one that's not authorized
    dataStore.disableToken(entry); 
    servletResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "This token is not authorized");
    return;
  }

  // turn request token into access token
  OAuthEntry accessEntry = dataStore.convertToAccessToken(entry);

  sendResponse(servletResponse, OAuth.newList(
      OAuth.OAUTH_TOKEN, accessEntry.token,
      OAuth.OAUTH_TOKEN_SECRET, accessEntry.tokenSecret,
      "user_id", entry.userId));
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
private static void handleException(Exception e, HttpServletRequest request,
    HttpServletResponse response, boolean sendBody)
    throws IOException, ServletException {
  String realm = (request.isSecure()) ? "https://" : "http://";

  if (request.getHeader("Host") != null) {
    realm += request.getHeader("Host");
  } else {
    realm += request.getLocalName();
  }
  OAuthServlet.handleException(response, e, realm, sendBody);
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
public SecurityToken getSecurityTokenFromRequest(HttpServletRequest request)
    throws InvalidAuthenticationException {
  OAuthMessage message = OAuthServlet.getMessage(request, null);
  if (StringUtils.isEmpty(getParameter(message, OAuth.OAUTH_SIGNATURE))) {
    // Is not an oauth request
    return null;
  }
  String bodyHash = getParameter(message, OAuthConstants.OAUTH_BODY_HASH);
  if (!StringUtils.isEmpty(bodyHash)) {
    verifyBodyHash(request, bodyHash);
  }
  try {
    return verifyMessage(message);
  } catch (OAuthProblemException oauthException) {
    // Legacy body signing is intended for backwards compatability with opensocial clients
    // that assumed they could use the raw request body as a pseudo query param to get
    // body signing. This assumption was born out of the limitations of the OAuth 1.0 spec which
    // states that request bodies are only signed if they are form-encoded. This lead many clients
    // to force a content type of application/x-www-form-urlencoded for xml/json bodies and then
    // hope that receiver decoding of the body didnt have encoding issues. This didn't work out
    // to well so now these clients are required to specify the correct content type. This code
    // lets clients which sign using the old technique to work if they specify the correct content
    // type. This support is deprecated and should be removed later.
    if (allowLegacyBodySigning &&
        (StringUtils.isEmpty(request.getContentType())  ||
        !request.getContentType().contains(OAuth.FORM_ENCODED))) {
      try {
        message.addParameter(readBodyString(request), "");
        return verifyMessage(message);
      } catch (OAuthProblemException ioe) {
        // ignore, let original exception be thrown
      } catch (IOException e) {
        // also ignore;
      }
    }
    throw new InvalidAuthenticationException("OAuth Authentication Failure", oauthException);
  }
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
@Override
public String getOAuthAccessToken(HttpServletRequest request) throws IOException {
    OAuthMessage message = OAuthServlet.getMessage(request, null);
    return message.getToken();
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
@Test
public void testValidateMessageFailsWhenNoConsumerKey() throws IOException, Exception{
    
    HttpServletRequest requestMock = Mockito.mock(HttpServletRequest.class);
    String url = "https://example.com/lti-launch";
    
    PowerMockito.mockStatic(OAuthServlet.class);
    OAuthMessage messageMock = Mockito.mock(OAuthMessage.class);
    
    PowerMockito.when(OAuthServlet.getMessage(requestMock, url)).thenReturn(messageMock);

    Mockito.when(messageMock.getConsumerKey()).thenThrow(new IOException("io exception"));

    LtiVerificationResult result = BasicLTIUtil.validateMessage(requestMock, url, "secret");

    Assert.assertEquals(LtiError.BAD_REQUEST, result.getError());
    Assert.assertEquals(Boolean.FALSE, result.getSuccess());
    
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
/**
 * tests compatibility of calculating the signature base string.
 */
@Test
public void testCalculateSignatureBaseString() throws Exception {
	final String baseUrl = "http://www.springframework.org/schema/security/";
	CoreOAuthProviderSupport support = new CoreOAuthProviderSupport() {
		@Override
		protected String getBaseUrl(HttpServletRequest request) {
			return baseUrl;
		}
	};

	Map<String, String[]> parameterMap = new HashMap<String, String[]>();
	parameterMap.put("a", new String[] { "value-a" });
	parameterMap.put("b", new String[] { "value-b" });
	parameterMap.put("c", new String[] { "value-c" });
	parameterMap.put("param[1]", new String[] { "aaa", "bbb" });

	when(request.getParameterNames()).thenReturn(Collections.enumeration(parameterMap.keySet()));
	for (Map.Entry<String, String[]> param : parameterMap.entrySet()) {
		when(request.getParameterValues(param.getKey())).thenReturn(param.getValue());
	}

	String header = "OAuth realm=\"http://sp.example.com/\","
			+ "                oauth_consumer_key=\"0685bd9184jfhq22\","
			+ "                oauth_token=\"ad180jjd733klru7\","
			+ "                oauth_signature_method=\"HMAC-SHA1\","
			+ "                oauth_signature=\"wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D\","
			+ "                oauth_timestamp=\"137131200\"," + "                oauth_callback=\""
			+ OAuthCodec.oauthEncode("http://myhost.com/callback") + "\","
			+ "                oauth_nonce=\"4572616e48616d6d65724c61686176\","
			+ "                oauth_version=\"1.0\"";
	when(request.getHeaders("Authorization")).thenReturn(Collections.enumeration(Arrays.asList(header)));
	when(request.getMethod()).thenReturn("GET");
	String ours = support.getSignatureBaseString(request);

	when(request.getHeaders("Authorization")).thenReturn(Collections.enumeration(Arrays.asList(header)));
	when(request.getParameterMap()).thenReturn(parameterMap);
	when(request.getHeaderNames()).thenReturn(null);
	OAuthMessage message = OAuthServlet.getMessage(request, baseUrl);

	String theirs = OAuthSignatureMethod.getBaseString(message);
	assertEquals(theirs, ours);
}
 

import net.oauth.server.OAuthServlet; //导入依赖的package包/类
@Override
protected void doGet(HttpServletRequest request,
        HttpServletResponse response) throws IOException {
    response.setHeader("Cache-Control", "no-cache");
    final OAuthMessage msg = OAuthServlet.getMessage(request, null);
    // System.out.print(Thread.currentThread().getName() + " " + msg.method + " ...");
    // System.out.flush();
    response.setCharacterEncoding(msg.getBodyEncoding());
    final ServletOutputStream out = response.getOutputStream();
    out.print(msg.method + "\n");
    out.print(OAuthSignatureMethod.normalizeParameters(msg.getParameters())
            + "\n");
    if ("true".equalsIgnoreCase(msg.getParameter("echoHeader"))) {
        {
            URL url = new URL(msg.URL);
            String path = url.getPath();
            String queryString = request.getQueryString();
            if (queryString != null) {
                path += ("?" + queryString);
            }
            out.println(msg.method + " " + path);
        }
        for (Enumeration<String> names = request.getHeaderNames(); names
                .hasMoreElements();) {
            final String name = names.nextElement();
            for (Enumeration<String> values = request.getHeaders(name); values
                    .hasMoreElements();) {
                final String value = values.nextElement();
                out.println(name + ": " + value);
            }
        }
        out.println();
    }
    if ("true".equalsIgnoreCase(msg.getParameter("echoParameters"))) {
        final List<Map.Entry<String, String>> parameters = msg
                .getParameters();
        for (Map.Entry<String, String> parameter : parameters) {
            out.println(parameter.getKey() + ": " + parameter.getValue());
        }
        out.println();
    }
    final String echoData = msg.getParameter("echoData");
    if (echoData != null) {
        int n = Integer.parseInt(echoData);
        for (; n > 0; n -= (DATA.length + 1)) {
            int len = Math.min(n - 1, DATA.length);
            out.write(DATA, 0, len);
            out.write('\n');
        }
        out.write('\n');
    }
    if (!"false".equalsIgnoreCase(msg.getParameter("echoBody"))) {
        out.print(request.getHeader("Content-Length") + "\n");
        InputStream in = msg.getBodyAsStream();
        byte[] body = readAll(in);
        out.write(body);
    }
    // out.close();
    // System.out.println("... done");
}