mdanter / oauth2v1

OAuth2v1

A demo and helper class for providing Google OAuth2 v1 authentication in java.

Assumptions

• familiarity with OOP, java, maven, and jee
• java application server listening on localhost:8080

Prerequisites

• Google API access credentials (Client ID, Client Secret). Set it up here https://code.google.com/apis/console/
• Set up allowed Redirect URIs at Google API -> API Access. Input: http://localhost:8080/OAuth2v1/index.jsp
• a positive outlook on life

Usage

1. Add Client ID, and Client Secret parameters to GoogleAuthHelper.java
2. Compile the project ($ mvn clean install)
3. Deploy war to application server
4. Browse to: http://localhost:8080/OAuth2v1/
5. Click "log in with google" on top of this page

oauth2v1's Issues

Anti-forgery state token

I could not find anywhere in your code that mentions about how to incorporate an anti-forgery state token. Please see Using OAuth2.0 for Login.

Or, do you have any idea where I can extend your code to include this special token for the sake of security.

SSLHandshakeException

I'm trying to run this code but I'm getting SSLHandshakeException.

Once login success in google when I'm clicking on access button getting this below exception.
Can you please help me what certificate do I need to install

Exception -

org.apache.jasper.JasperException: An exception occurred processing JSP page /index.jsp at line 86


83: * At this point you should parse and persist the info.
84: */
85:
86: out.println(helper.getUserInfoJson(request.getParameter("code")));
87:
88: out.println("");
89: }


Stacktrace:
org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:568)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:460)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:390)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:334)
javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

root cause javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target sun.security.ssl.Alerts.getSSLException(Unknown Source) sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) sun.security.ssl.Handshaker.fatalSE(Unknown Source) sun.security.ssl.Handshaker.fatalSE(Unknown Source) sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source) sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)