Higher-level interface that allows callers to store and retrieve
OAuth-related data directly from
for a more detailed explanation of the OAuth
OAuthStore that can store and retrieve OAuth
tokens, as well as information about service providers.
Retrieve an AccessorInfo and OAuthAccessor that are ready for signing OAuthMessages. To do
this, we need to figure out:
- what consumer key/secret to use for signing.
- if an access token should be used for the request, and if so what it is. *
- the OAuth request/authorization/access URLs.
- what HTTP method to use for request token and access token requests
- where the OAuth parameters are located.
Note that most of that work gets skipped for signed fetch, we just look up the consumer key
and secret for that. Signed fetch always sticks the parameters in the query string.
OAuthServiceProvider provider = null;
provider = lookupSpecInfo(securityToken, arguments, accessorBuilder, responseParams);
"Unable to retrieve consumer key", e);
lookupToken(securityToken, consumer, arguments, clientState, accessorBuilder, responseParams);
Lookup information contained in the gadget spec.
"Failed to retrieve OAuth URLs, spec for gadget " +
securityToken.getAppUrl() + " does not contain OAuth element.");
"Failed to retrieve OAuth URLs, spec for gadget does not contain OAuth service " +
return new OAuthServiceProvider(
return new OAuthServiceProvider(requestTokenUrl, authorizationUrl, accessTokenUrl);
Figure out the OAuth token that should be used with this request. We check for this in three
places. In order of priority:
1) From information we cached on the client.
We encrypt the token and cache on the client for performance.
2) From information we have in our persistent state.
We persist the token server-side so we can look it up if necessary.
3) From information the gadget developer tells us to use (a preapproved request token.)
Gadgets can be initialized with preapproved request tokens. If the user tells the service
provider they want to add a gadget to a gadget container site, the service provider can
create a preapproved request token for that site and pass it to the gadget as a user
"Unable to retrieve access token", e);
"Unknown parameter location " + location);
"Could not fetch gadget spec, gadget URI invalid.", e);
"Could not fetch gadget spec", e);
Store an access token for the given user/gadget/service/token name
"Unable to store access token", e);
Remove an access token for the given user/gadget/service/token name
"Unable to remove access token", e);