javaspring-mvcoauth-2.0oltu

Library for a flexible authentication in Spring MVC with Oauth2.0


EDIT:

I'm doing this for the first time and I don't know what to choose for my case. I've got a Spring MVC project set up on my server(it's just a single page web app) and would like to add some "custom API calls" so that my users can access their data on behalf of my app .

Examples (Imagine a blank page where a user added his preferred links in his listBox):

facebook.com/get_my_latest_posts gym.com/pay_my_membership butcher.com/buy_2kg_beef

The user can edit/add links anytime he wants. When he clicks a link , the link is being called and the user receives his facebook latest posts, confirmation that the gym membership has been paid or confirmation that he bought 2kg of beef. (a result based on what link was called)

I wouldn't want to bring the user always a login page, so I'll try to use an access token where possible.

Does this sound like science fiction ?

If it doesn't, then I saw the spring social examples but wouldn't be better if I used a library like google's OAUTH library or Apache Oltu ?


Solution

  • Spring Social, Google's OAuth Client Library for Java and Apache Oltu fulfill the oauth specification and are all good candidates. Every library comes with some predefined providers. Spring Social and Apache Oltu contains some popular platforms like Facebook, Twitter, Github or Google. Google OAuth Client Library for Java comes along with the Google API Client Library for Java in order to connect to Google services. In Spring Social and Google OAuth Client Library those providers are optional.

    All three libraries are written in a generic way so that one can connect to any oauth provider. I think that Spring Social could require less integration work than Apache Oltu or Google OAuth Client Library in regard to other Spring modules like Spring Security or MVC. In the end it all boils down to your personal preference for a library.

    If you decide for Spring Social, take a look at this quickstart demo (ignore the README.md and just run ./gradlew bootRun). It already contains everything you described in the comments of your question:

    As you can see in the demo, you can't prevent that your users have to authenticate with every third party once in a time. This happens usually when there is no access or refresh token or the token has expired.

    Take a look at the Spring Social documentation on how to add a new service provider.

    Summary

    All three libraries are extensible and fit your needs. There are many examples on the internet for every library. Spring Social could require less integration work into an existing Spring application.

    Your application is just a host for many oauth clients for different services (so no science fiction here). You'll need to think about storing the access and refresh token on a per user basis somewhere (database?). You'll need to provide an after authorization callback url in your application for every service you want to integrate.