Mailing-List: contact amber-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: amber-dev@incubator.apache.org
Received-SPF: pass (nike.apache.org: domain of simone.tripodi@gmail.com
 designates 209.85.215.175 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=GHbxDtadSjEhGyAej7Qufk04yNZvjx7fZQyrHnCqCbPyIEwvgUIa6PRBqgjK7VNJ+f
         MKsG+VajQTCQ6+atTJdFVMIzYB0ZUdzaQsuLfF6Sk26TSV+/fNz3VNh0rvdVJ2Ll76Ju
         ZMp1Ox4a3vEPYOMIbDJN3imV0Or2HeJGMVTMQ=
MIME-Version: 1.0
In-Reply-To: <4C36FA46.5050107@pidster.com>
References: <AANLkTilm1CQeecdUoHV5ck70JgbSUyvWoxO2iTLR4SW4@mail.gmail.com>
	<4C36FA46.5050107@pidster.com>
Date: Fri, 9 Jul 2010 12:41:09 +0200
Message-ID: <AANLkTimHJbWJiGMJST9FhPxEPAvOnz8ofruUIW9Y3LPG@mail.gmail.com>
Subject: Re: Question about the token secret?
From: Simone Tripodi <simone.tripodi@gmail.com>
To: amber-dev@incubator.apache.org, pid@pidster.com
Content-Type: text/plain; charset=UTF-8

Agreed, good catch,
that means that it has to be added to SignatureMethods methods
signature, since in client/server we have totally different statuses.
Something cheated me, thanks for the advice :)
Simo

http://people.apache.org/~simonetripodi/
http://www.99soft.org/


On Fri, Jul 9, 2010 at 12:30 PM, Pid <pid@pidster.com> wrote:
> On 09/07/2010 11:03, Simone Tripodi wrote:
>> The token secret (aka secret credential) is required (empty, if not
>> known) to generate signatures (at least to PLAINTEX and HMAC methods),
>> so sounds it is currently missing in the SignatureMethod methods
>> signatures
>>
>> OR
>>
>> has to be added in the OAuthRequest ???
>
> Yes - we'll need it somewhere.
>
> Maybe the request could have an OAuthToken getToken() method and we'll
> store the token component(s) separately from the other values?
>
> In client mode it would be available in the token.
>
> In server mode we'd have to look it up from the TokenStorage, using the
> key supplied in the request and update the token before passing it to
> SignatureMethod.
>
>
> p
>
>> I'd suggest for the second option, WDYT?
>>
>> Thanks in advance, have a nice day!
>> Simo
>>
>> http://people.apache.org/~simonetripodi/
>> http://www.99soft.org/
>
>
>