Guide for bearer token validation by a Java web service using Oltu?How resource server in OAuth authentication system, verify the token?How to call a SOAP web service on AndroidCreate a GUID in JavaValidate Oauth Access Token in WCF Message InspectorWeb API 2 OWIN Bearer token authentication - AccessTokenFormat null?How does ASP.Net Web API validate OAuth 2.0 token?pass openid-connect oauth2 bearer token in headerApache oltu Oauth2 token validationASP.NET5 & JWT Bearer TokensUse OAuth Bearer Token instead of PAT in Ajax calls to VSTS APIOAuth 2 Web API 2 Bearer Token Two Factor Authentication 2FA

Why is it a bad idea to hire a hitman to eliminate most corrupt politicians?

Where would I need my direct neural interface to be implanted?

Placement of More Information/Help Icon button for Radio Buttons

Send out email when Apex Queueable fails and test it

How to compactly explain secondary and tertiary characters without resorting to stereotypes?

What are the G forces leaving Earth orbit?

Can someone clarify Hamming's notion of important problems in relation to modern academia?

What do you call someone who asks many questions?

How to install cross-compiler on Ubuntu 18.04?

Getting extremely large arrows with tikzcd

Implication of namely

What is the most common color to indicate the input-field is disabled?

Does marriage to a non-Numenorean disqualify a candidate for the crown of Gondor?

What Exploit Are These User Agents Trying to Use?

Bullying boss launched a smear campaign and made me unemployable

How exploitable/balanced is this homebrew spell: Spell Permanency?

Why do I get negative height?

What's the meaning of "Sollensaussagen"?

How to travel to Japan while expressing milk?

Why was Sir Cadogan fired?

Avoiding the "not like other girls" trope?

How could indestructible materials be used in power generation?

Machine learning testing data

files created then deleted at every second in tmp directory



Guide for bearer token validation by a Java web service using Oltu?


How resource server in OAuth authentication system, verify the token?How to call a SOAP web service on AndroidCreate a GUID in JavaValidate Oauth Access Token in WCF Message InspectorWeb API 2 OWIN Bearer token authentication - AccessTokenFormat null?How does ASP.Net Web API validate OAuth 2.0 token?pass openid-connect oauth2 bearer token in headerApache oltu Oauth2 token validationASP.NET5 & JWT Bearer TokensUse OAuth Bearer Token instead of PAT in Ajax calls to VSTS APIOAuth 2 Web API 2 Bearer Token Two Factor Authentication 2FA













0















I'm adding a simple web service to an older application that needs to authenticate via OAuth 2.0. Since the app uses older technologies (Java 6, Tomcat 6, Struts 1, no Spring Framework) and upgrading the app is not currently in the scope, budget, or schedule for the project, I'm working with the Apache Oltu libraries -- older, but they appear to be adequate for my needs.



The service will be passed a bearer token from the consumer in the request headers, which I can retrieve. I believe next would be to pass the token with the web service's client id and secret from it's authorization OAuth account to an (as yet unknown to me) Oltu token validation routine that will use a PingFederate URL in our company's domain for validation (i.e., "https://fedlogin.xxx.com/as/token.oauth2"), and get back whether or not it's a valid token. This is a very low traffic web service, so I don't think I need to worry about refresh tokens, storing anything in keyvaults/caches/databases, etc.



What I'm looking for seems simple, but maybe I'm oversimplifying things in my understanding of the process. I've found lots of examples online but not a guide or example that lays out the correct method(s), parameters, etc. to validate the bearer token in this situation. I've unsuccessfully tried a number of different variations on examples I've found online. I'm new to OAuth so I may be having difficulty with the terminology and naming conventions for the available classes and methods.



Can anyone suggest (or guide me to) a method to quickly and simply validate the bearer token using Oltu? Am I on the right track or am I missing/misunderstanding something fundamental in how OAuth 2 validation from a web service's perspective works?



Edit: I think I may have an answer for why I can't find a solution in the Oltu library -- it doesn't exist. See my response below...










share|improve this question




























    0















    I'm adding a simple web service to an older application that needs to authenticate via OAuth 2.0. Since the app uses older technologies (Java 6, Tomcat 6, Struts 1, no Spring Framework) and upgrading the app is not currently in the scope, budget, or schedule for the project, I'm working with the Apache Oltu libraries -- older, but they appear to be adequate for my needs.



    The service will be passed a bearer token from the consumer in the request headers, which I can retrieve. I believe next would be to pass the token with the web service's client id and secret from it's authorization OAuth account to an (as yet unknown to me) Oltu token validation routine that will use a PingFederate URL in our company's domain for validation (i.e., "https://fedlogin.xxx.com/as/token.oauth2"), and get back whether or not it's a valid token. This is a very low traffic web service, so I don't think I need to worry about refresh tokens, storing anything in keyvaults/caches/databases, etc.



    What I'm looking for seems simple, but maybe I'm oversimplifying things in my understanding of the process. I've found lots of examples online but not a guide or example that lays out the correct method(s), parameters, etc. to validate the bearer token in this situation. I've unsuccessfully tried a number of different variations on examples I've found online. I'm new to OAuth so I may be having difficulty with the terminology and naming conventions for the available classes and methods.



    Can anyone suggest (or guide me to) a method to quickly and simply validate the bearer token using Oltu? Am I on the right track or am I missing/misunderstanding something fundamental in how OAuth 2 validation from a web service's perspective works?



    Edit: I think I may have an answer for why I can't find a solution in the Oltu library -- it doesn't exist. See my response below...










    share|improve this question


























      0












      0








      0








      I'm adding a simple web service to an older application that needs to authenticate via OAuth 2.0. Since the app uses older technologies (Java 6, Tomcat 6, Struts 1, no Spring Framework) and upgrading the app is not currently in the scope, budget, or schedule for the project, I'm working with the Apache Oltu libraries -- older, but they appear to be adequate for my needs.



      The service will be passed a bearer token from the consumer in the request headers, which I can retrieve. I believe next would be to pass the token with the web service's client id and secret from it's authorization OAuth account to an (as yet unknown to me) Oltu token validation routine that will use a PingFederate URL in our company's domain for validation (i.e., "https://fedlogin.xxx.com/as/token.oauth2"), and get back whether or not it's a valid token. This is a very low traffic web service, so I don't think I need to worry about refresh tokens, storing anything in keyvaults/caches/databases, etc.



      What I'm looking for seems simple, but maybe I'm oversimplifying things in my understanding of the process. I've found lots of examples online but not a guide or example that lays out the correct method(s), parameters, etc. to validate the bearer token in this situation. I've unsuccessfully tried a number of different variations on examples I've found online. I'm new to OAuth so I may be having difficulty with the terminology and naming conventions for the available classes and methods.



      Can anyone suggest (or guide me to) a method to quickly and simply validate the bearer token using Oltu? Am I on the right track or am I missing/misunderstanding something fundamental in how OAuth 2 validation from a web service's perspective works?



      Edit: I think I may have an answer for why I can't find a solution in the Oltu library -- it doesn't exist. See my response below...










      share|improve this question
















      I'm adding a simple web service to an older application that needs to authenticate via OAuth 2.0. Since the app uses older technologies (Java 6, Tomcat 6, Struts 1, no Spring Framework) and upgrading the app is not currently in the scope, budget, or schedule for the project, I'm working with the Apache Oltu libraries -- older, but they appear to be adequate for my needs.



      The service will be passed a bearer token from the consumer in the request headers, which I can retrieve. I believe next would be to pass the token with the web service's client id and secret from it's authorization OAuth account to an (as yet unknown to me) Oltu token validation routine that will use a PingFederate URL in our company's domain for validation (i.e., "https://fedlogin.xxx.com/as/token.oauth2"), and get back whether or not it's a valid token. This is a very low traffic web service, so I don't think I need to worry about refresh tokens, storing anything in keyvaults/caches/databases, etc.



      What I'm looking for seems simple, but maybe I'm oversimplifying things in my understanding of the process. I've found lots of examples online but not a guide or example that lays out the correct method(s), parameters, etc. to validate the bearer token in this situation. I've unsuccessfully tried a number of different variations on examples I've found online. I'm new to OAuth so I may be having difficulty with the terminology and naming conventions for the available classes and methods.



      Can anyone suggest (or guide me to) a method to quickly and simply validate the bearer token using Oltu? Am I on the right track or am I missing/misunderstanding something fundamental in how OAuth 2 validation from a web service's perspective works?



      Edit: I think I may have an answer for why I can't find a solution in the Oltu library -- it doesn't exist. See my response below...







      java oauth-2.0 oltu






      share|improve this question















      share|improve this question













      share|improve this question




      share|improve this question








      edited Mar 8 at 22:00







      MrLuckypants

















      asked Mar 8 at 20:29









      MrLuckypantsMrLuckypants

      32




      32






















          1 Answer
          1






          active

          oldest

          votes


















          0














          I believe I have found an answer in a previous post to my question :



          "This interaction between the RS and the AS is not part of the OAuth 2.0 standard ... and it's up to the AS implementation to decide how to accomplish this task." -- How resource server in OAuth authentication system, verify the token?



          This is the part I was missing -- the implementation of the authentication method used by the resource server to validate the client's token against the authentication server is left up to the authorization server. This means that it will likely not be included in many general-purpose OAuth 2.0 libraries such as Oltu (which is why I could not find one). In my case, I'll need to find an older version of the PingFederate Java Integration Kit since our company uses a PingFederate server for authentication.






          share|improve this answer























            Your Answer






            StackExchange.ifUsing("editor", function ()
            StackExchange.using("externalEditor", function ()
            StackExchange.using("snippets", function ()
            StackExchange.snippets.init();
            );
            );
            , "code-snippets");

            StackExchange.ready(function()
            var channelOptions =
            tags: "".split(" "),
            id: "1"
            ;
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function()
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled)
            StackExchange.using("snippets", function()
            createEditor();
            );

            else
            createEditor();

            );

            function createEditor()
            StackExchange.prepareEditor(
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader:
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            ,
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            );



            );













            draft saved

            draft discarded


















            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55070566%2fguide-for-bearer-token-validation-by-a-java-web-service-using-oltu%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            0














            I believe I have found an answer in a previous post to my question :



            "This interaction between the RS and the AS is not part of the OAuth 2.0 standard ... and it's up to the AS implementation to decide how to accomplish this task." -- How resource server in OAuth authentication system, verify the token?



            This is the part I was missing -- the implementation of the authentication method used by the resource server to validate the client's token against the authentication server is left up to the authorization server. This means that it will likely not be included in many general-purpose OAuth 2.0 libraries such as Oltu (which is why I could not find one). In my case, I'll need to find an older version of the PingFederate Java Integration Kit since our company uses a PingFederate server for authentication.






            share|improve this answer



























              0














              I believe I have found an answer in a previous post to my question :



              "This interaction between the RS and the AS is not part of the OAuth 2.0 standard ... and it's up to the AS implementation to decide how to accomplish this task." -- How resource server in OAuth authentication system, verify the token?



              This is the part I was missing -- the implementation of the authentication method used by the resource server to validate the client's token against the authentication server is left up to the authorization server. This means that it will likely not be included in many general-purpose OAuth 2.0 libraries such as Oltu (which is why I could not find one). In my case, I'll need to find an older version of the PingFederate Java Integration Kit since our company uses a PingFederate server for authentication.






              share|improve this answer

























                0












                0








                0







                I believe I have found an answer in a previous post to my question :



                "This interaction between the RS and the AS is not part of the OAuth 2.0 standard ... and it's up to the AS implementation to decide how to accomplish this task." -- How resource server in OAuth authentication system, verify the token?



                This is the part I was missing -- the implementation of the authentication method used by the resource server to validate the client's token against the authentication server is left up to the authorization server. This means that it will likely not be included in many general-purpose OAuth 2.0 libraries such as Oltu (which is why I could not find one). In my case, I'll need to find an older version of the PingFederate Java Integration Kit since our company uses a PingFederate server for authentication.






                share|improve this answer













                I believe I have found an answer in a previous post to my question :



                "This interaction between the RS and the AS is not part of the OAuth 2.0 standard ... and it's up to the AS implementation to decide how to accomplish this task." -- How resource server in OAuth authentication system, verify the token?



                This is the part I was missing -- the implementation of the authentication method used by the resource server to validate the client's token against the authentication server is left up to the authorization server. This means that it will likely not be included in many general-purpose OAuth 2.0 libraries such as Oltu (which is why I could not find one). In my case, I'll need to find an older version of the PingFederate Java Integration Kit since our company uses a PingFederate server for authentication.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered Mar 8 at 22:10









                MrLuckypantsMrLuckypants

                32




                32





























                    draft saved

                    draft discarded
















































                    Thanks for contributing an answer to Stack Overflow!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid


                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.

                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function ()
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55070566%2fguide-for-bearer-token-validation-by-a-java-web-service-using-oltu%23new-answer', 'question_page');

                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Identity Server 4 is not redirecting to Angular app after login2019 Community Moderator ElectionIdentity Server 4 and dockerIdentityserver implicit flow unauthorized_clientIdentityServer Hybrid Flow - Access Token is null after user successful loginIdentity Server to MVC client : Page Redirect After loginLogin with Steam OpenId(oidc-client-js)Identity Server 4+.NET Core 2.0 + IdentityIdentityServer4 post-login redirect not working in Edge browserCall to IdentityServer4 generates System.NullReferenceException: Object reference not set to an instance of an objectIdentityServer4 without HTTPS not workingHow to get Authorization code from identity server without login form

                    2005 Ahvaz unrest Contents Background Causes Casualties Aftermath See also References Navigation menue"At Least 10 Are Killed by Bombs in Iran""Iran"Archived"Arab-Iranians in Iran to make April 15 'Day of Fury'"State of Mind, State of Order: Reactions to Ethnic Unrest in the Islamic Republic of Iran.10.1111/j.1754-9469.2008.00028.x"Iran hangs Arab separatists"Iran Overview from ArchivedConstitution of the Islamic Republic of Iran"Tehran puzzled by forged 'riots' letter""Iran and its minorities: Down in the second class""Iran: Handling Of Ahvaz Unrest Could End With Televised Confessions""Bombings Rock Iran Ahead of Election""Five die in Iran ethnic clashes""Iran: Need for restraint as anniversary of unrest in Khuzestan approaches"Archived"Iranian Sunni protesters killed in clashes with security forces"Archived

                    Can't initialize raids on a new ASUS Prime B360M-A motherboard2019 Community Moderator ElectionSimilar to RAID config yet more like mirroring solution?Can't get motherboard serial numberWhy does the BIOS entry point start with a WBINVD instruction?UEFI performance Asus Maximus V Extreme