Two-legged oauth is one option. You won't actually find that term in the oauth specification; however, if you are just wanting API authentication then all you need is the message signing parts of oauth. Using it this way has become colloquially referred to as two-legged oauth.
There is some sample code from the oauth group here (it is a subversion repository that has anonymous read on):
http://oauth.googlecode.com/svn/code/java/Specifically for the message validation take a look at the validateMessage() method in the SimpleOAuthValidator class.
http://oauth.googlecode.com/svn/code/java/jmeter/core/commons/src/main/java/net/oauth/SimpleOAuthValidator.javaBasically how it works is you give a private key (consumer secret in oauth speak) to the person (different for each user) using your api. They hash the calls to your API with their secret key, then when you get the request you do the same hashing algorithm (since you have the private key too) and if they match you now that person is authenticates. A username is also passed in the request (consumer key in oauth speak), if they authenticate then you can authorize with that username (and of course you need that username to look up their private key). The only time the private key is sent over the wire is during the initial key exchange (use SSL website to generate and transfer).
OAuth has a very strict way of generating the hash that is the message signature (Section 3 of the RFC
http://tools.ietf.org/html/rfc5849#section-3). The sample code I link to above has an implementation of it. As far as user's making requests to your API there are plenty of libraries out there that can generate good oauth requests (i.e. with the strict hash generation in section 3) in a variety of languages (see
http://oauth.net/code/). Signpost can generate oauth requests if your API users will be using Java:
http://code.google.com/p/oauth-signpost/The only thing that would then be up to you is generation of the private keys. You can hit google for some ideas. One way if you run on a unix platform you can get read random bytes from /dev/random then hash them. (how many bytes you read will determine how secure your keys are).
On Aug 2, 2012, at 11:46 AM, Mihai Cazacu <
[hidden email]<mailto:
[hidden email]>> wrote:
Hi,
I'm trying to decouple my applications using this schema:
[db1] \ / [android]
[db2] - [rest api] - [iphone]
[dbN] / \ [web]
and I don't know how to implement authentication/authorization for REST requests. What do you recommend:
basic auth + SSL, oauth1, oauth2, SSL only for login and the rest of the requests using an accessToken?
Eventually, do you know some useful links?
Thanks,
Mihai
---------------------------------------------------------------------
To unsubscribe from this list, please visit:
http://xircles.codehaus.org/manage_email
Locked
