Google 2 legged oauth

参考文档：

* 2 legged oauth基本概念(中文) http://djb4ke.iteye.com/blog/664958

* google 2 legged oauth for google apps domain: http://code.google.com/intl/zh-TW/apis/accounts/docs/OAuth.html#GoogleAppsOAuth

* 使用google client library来进行google 2 legged oauth的例子: http://code.google.com/intl/zh-TW/apis/gdata/docs/auth/oauth.html#2LeggedOAuth

Two legs的意思是OAuth的参与者为两个：Social Network Server和App server.

2-legged OAuth协议是两个服务器backend的交互，与3-legged相比，缺少了user这个角色，不需要经过user-agent(Gadget，浏览器等)。

因为不需要user，所以自然不需要用户认证。这就要求用户事先已经允许App Server访问存放于Social Site的私人数据。

2-legged 与 3-legged的区别及联系

OAuth一般是指3-legged OAuth，这点从OAuth协议就能看出，整个OAuth的过程需要用户的这个角色，用户需要登录（身份认证）和允许APP访问数据（授权操作）。因此3 legged OAuth是OAuth的标准版本，并已被Yahoo Google Aol等部署应用，3-legged需要用户的参与，从OAuth consmer开始，重定向到OAuth provider，去做登录及授权，如果授权通过，用户又被弹回OAuth consumer，因此用户这一些列操作被戏称为“dance”。而这支非常灵动的舞蹈，让整个网络的app和数据互动起来了，但是代价却是让用户头晕的一些列操作，用户体验是非常差的= =#（可以想想，一个并不了解OAuth流程的用户，对于两个site间来回跳并且要阅读很多类似法律条款的授权警告，以及操作，是多么的困惑）

阅读完上面的参考文档和基本概念后，下面step by step搭建一个google 2 legged oauth的最简单的环境和例子

Step 1: 申请一个google apps for education at http://www.google.com/apps/intl/en/edu/get_apps.html，我之前申请了一个，URL is https://www.google.com/a/chtl.hkbu.edu.hk

Step 2: 以admin登录step 1申请的google apps, access "Advance Tools > Manage OAuth domain key"，选上"Two-legged OAuth access control" option, and then click "save changes" button

Step 3: 为了执行step 4的code，我在chtl.hkbu.edu.hk google app里create a user "student1@chtl.hkbu.edu.hk"

Step 4: create following class

package example_tomson.twoleggedoauth;

import java.net.URL;

import sample.oauth.TwoLeggedOAuthUserInputHelper;
import sample.oauth.UserInputHelper;
import sample.oauth.UserInputVariables;

import com.google.gdata.client.GoogleService;
import com.google.gdata.client.authn.oauth.GoogleOAuthHelper;
import com.google.gdata.client.authn.oauth.GoogleOAuthParameters;
import com.google.gdata.client.authn.oauth.OAuthHmacSha1Signer;
import com.google.gdata.client.authn.oauth.OAuthSigner;
import com.google.gdata.data.BaseEntry;
import com.google.gdata.data.BaseFeed;
import com.google.gdata.data.Feed;

/**
 * 演示google 2 legged oauth。
 * 
 * 在使用google 2 legged oauth之前，需要要在http://www.google.com/apps/intl/en/edu/get_apps.html 
 * 申请一个google apps for education/business
 */
public class TwoLeggedOauthExample {
	public static void main(String[] args) throws Exception {
		//来自chtl.hkbu.edu.hk google apps domain https://www.google.com/a/chtl.hkbu.edu.hk
		String oauthConsumerKey="chtl.hkbu.edu.hk";
		String oauthConsumerSecret="xxx";
		
		String scope = "http://www.google.com/calendar/feeds/";
		String strCalendarFeedUrl="http://www.google.com/calendar/feeds/default/allcalendars/full";

		//该值会以"xoauth_requestor_id" param的值添加到feed url里
		//它用来设置which user you are loading the data for.
		//例如，to access chtl.hkbu.edu.hk google apps domain的user "student1@chtl.hkbu.edu.hk"
		String xoauthRequestorId="student1@chtl.hkbu.edu.hk"; 
		// !!!Append the "xoauth_requestor_id" parameter to the feed url. This
		// parameter indicates which user you are loading the data for.
		strCalendarFeedUrl += "?xoauth_requestor_id=" + xoauthRequestorId;
		
		// //
		// STEP 1: Set up the OAuth objects
		// //

		// You first need to initialize a few OAuth-related objects.
		// GoogleOAuthParameters holds all the parameters related to OAuth.
		// OAuthSigner is responsible for signing the OAuth base string.
		GoogleOAuthParameters oauthParameters = new GoogleOAuthParameters();
		oauthParameters.setOAuthConsumerKey(oauthConsumerKey);
		oauthParameters.setOAuthConsumerSecret(oauthConsumerSecret);
		// Set the scope for this particular service.
		oauthParameters.setScope(scope);
		// Initialize the OAuth Signer. 2-Legged OAuth must use HMAC-SHA1!
		OAuthSigner signer = new OAuthHmacSha1Signer();		
		// create a new GoogleOAuthHelperObject which is used for all OAuth-related interaction.
		GoogleOAuthHelper oauthHelper = new GoogleOAuthHelper(signer);

		// //
		// STEP 2: Make a request to Google
		// //

		URL feedUrl = new URL(strCalendarFeedUrl);

		System.out.println("Sending request to " + feedUrl.toString());
		System.out.println();
		String googleServiceName = "cl";
		//!!注意第2个参数的值
		GoogleService googleService = new GoogleService(googleServiceName, "2-legged-oauth-sample-app");

		// Set the OAuth credentials which were obtained from the steps above.
		googleService.setOAuthCredentials(oauthParameters, signer);

		// Make the request to Google
		BaseFeed resultFeed = googleService.getFeed(feedUrl, Feed.class);
		System.out.println("Response Data:");
		System.out.println("=====================================================");
		System.out.println("| TITLE: " + resultFeed.getTitle().getPlainText());
		if (resultFeed.getEntries().size() == 0) {
			System.out.println("|\tNo entries found.");
		} else {
			for (int i = 0; i < resultFeed.getEntries().size(); i++) {
				BaseEntry entry = (BaseEntry) resultFeed.getEntries().get(i);
				System.out.println("|\t" + (i + 1) + ": "
						+ entry.getTitle().getPlainText());
			}
		}
		System.out.println("=====================================================");
	}
}

step 5: run it, you will get calendar list of student1@chtl.hkbu.edu.hk