Java SE (Java Platform, Standard Edition)

Hi Ronaldo,

                 An excellent and helpful article.

Thank you so much for posting this.

Good Article!

I caught up your step and succeeded. But I cannot change the OAuth Identity Store(UserProfile?) to OUD instead of Embedded LDAP. When I change the default User Store to my OUD instances. the 401 Unauthorized error occurred after authentication. your code succeeded  only when a user who exists in Embedded LDAP and OUD Both.

Can you point me out something missed?

Good Article!

I caught up your step and succeeded. But I cannot change the OAuth Identity Store(UserProfile?) to OUD instead of Embedded LDAP. When I change the default User Store to my OUD instances. the 401 Unauthorized error occurred after authentication. your code succeeded  only when a user who exists in Embedded LDAP and OUD Both.

Can you point me out something missed?

Verify in WLS if Control Flag of DefaultAuthenticator is set to to SUFFICIENT.

Cool Article.

I have tried to do all this with OAM 11.1.2.2 and WebLogic 10.3.6. I am able to deploy but after i call the web application servlet

https://mobile.webapplication.de/web/CustomerInfo

the servlet sends the redirect to OAM

https://myoam.server.de/ms_oauth/oauth2/endpoints/oauthservice/authorize?

       response_type=code&

       client_id=customerClient&

       redirect_uri=https://mobile.webapplication.de/web/CustomerInfo&

       scope=Customer.info%20UserProfile.me&

       state=abc

I get a second redirect

https://myoam.server.de/ms_oauth/oauth2/ui/oauthservice/showconsent?

       response_type=code&

       client_id=customerClient&

       redirect_uri=https%3A%2F%2Fmobile.webapplication.de%2Fweb%2FCustomerInfo&

       scope=Customer.info+UserProfile.me&

       state=abc&

       oracle_client_name=customerClient

and this ALWAYS results in a 401 Unauthorized.

There is no redirection to the OAM Login Page.

I have checked the OAM configuration several times and it is exactly as in this article.

Any idea?

Regards

Edmund

Verify in WLS if Control Flag of DefaultAuthenticator is set to to SUFFICIENT.

After change to sufficient, It throws 403 instead of 401. the last uri was http://xxx.xxx.xxx.xxx:14100/ms_oauth/oauth2/ui/oauthservice/showconsent?response_type=code&client_id=customerCli…

Cool Article.

I have tried to do all this with OAM 11.1.2.2 and WebLogic 10.3.6. I am able to deploy but after i call the web application servlet

https://mobile.webapplication.de/web/CustomerInfo

the servlet sends the redirect to OAM

https://myoam.server.de/ms_oauth/oauth2/endpoints/oauthservice/authorize?

       response_type=code&

       client_id=customerClient&

       redirect_uri=https://mobile.webapplication.de/web/CustomerInfo&

       scope=Customer.info%20UserProfile.me&

       state=abc

I get a second redirect

https://myoam.server.de/ms_oauth/oauth2/ui/oauthservice/showconsent?

       response_type=code&

       client_id=customerClient&

       redirect_uri=https%3A%2F%2Fmobile.webapplication.de%2Fweb%2FCustomerInfo&

       scope=Customer.info+UserProfile.me&

       state=abc&

       oracle_client_name=customerClient

and this ALWAYS results in a 401 Unauthorized.

There is no redirection to the OAM Login Page.

I have checked the OAM configuration several times and it is exactly as in this article.

Any idea?

Regards

Edmund

There is no redirection to OAM Login Page because probably you are already logged on OAM. Logout first or open a private window in the browser.

After change to sufficient, It throws 403 instead of 401. the last uri was http://xxx.xxx.xxx.xxx:14100/ms_oauth/oauth2/ui/oauthservice/showconsent?response_type=code&client_id=customerCli…

Not sure what's going on. There are no access restrictions in the scenario. Did you verify if 403 is coming from OAM or WLS?

Thanks, a very useful and nice article.

Unfortunately I am also stuck to issue which is being faced by above users

When I try to access my URL of web application:  http://<<hostname>>:7001/CustomerWeb/CustomerInfo

I am getting same :

http://<<hostname>>:14100/ms_oauth/oauth2/ui/oauthservice/showconsent?response_type=code&client_id=customerClient&redire…

I am using OAM 11.1.2.2.0 and Weblogic 10.3.6 .

Any suggestion for the above issue? I cleared the session and tried it in new private browser, but everytime I encountered the same issue.

~J

Hi Ronaldo,

This is a great article.  My question is if this can be extended to use with staight "Apache 2.2" and Tomcat?  We are using OAM 11G R2 PS2 with WNA but our deployment is WebGates on Apache 2.2 which connect to Tomcat. This is an interesting approach I have read teh section called "46.6 Configuring a WebGate to Support the OAuth Service".  Which states "The WebGate serves as a proxy so that client authorization and token endpoint requests access the WebGate instead of accessing the Oracle Access Management server directly".  We are trying to use OAM with the OAM OAUTH 2.0 server to access out web service.  We have been working with Andre who also is based in Brazil.  I know we can include the OAUTH 2.0 jar file to call the APIs but I am trying to see how I can access the OAM authenication schemes from there to authenicate a "service account". 

Regards,

- Bob Anderson

Hi,

Thanks for the good article.When I am trying to access the web url http://ABC:5001/AnnaWeb/CustomerInfo I am getting 401 - Unauthorized error.The following error is seen in weblogic console.

java.io.FileNotFoundException: Response: '401: Unauthorized' for url: 'http://ABC:14100/ms_oauth/oauth2/endpoints/oauthservice/tokens'

        at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:511)

        at weblogic.net.http.SOAPHttpURLConnection.getInputStream(SOAPHttpURLConnection.java:37)

        at rest.CustomerRequester.getAccessToken(CustomerRequester.java:119)

        at rest.CustomerRequester.getCustomerInfo(CustomerRequester.java:67)

        at web.CustomerServlet.doGet(CustomerServlet.java:44)

        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)

        at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)

I have double checked the OAM settings from this article.I am using WL10.3.6 and OAM11gR2PS2

After change to sufficient, It throws 403 instead of 401. the last uri was http://xxx.xxx.xxx.xxx:14100/ms_oauth/oauth2/ui/oauthservice/showconsent?response_type=code&client_id=customerCli…

I was able to get past the 403 error by adding my OUD as a WLS Authentication Provider. I believe the reason for the 403 is that you have a session with a user that weblogic doesn't recognize thus blocks access completely due to safety reasons. Please do correct me if I'm wrong, I'm new to the whole OAM Oauth world so just figuring it all out.

Not related to this but I am trying to implement the C2B use case of OAuth as provided in:

http://www.ateam-oracle.com/implementing-oauth-2-with-oracle-access-manager-oauth-services-part-iii/

Now I am able to get the authorization code from OAuth server but when I request for access_token I get invalid grant error. Here is my CustomerClient:

Client ID: customerClient

Client Secret: vf740eNWVT8F0lhW

HTTP Redirect URIs: http://ms.ap.com:7001/ClientWebApp/CustomerClient

Allowed Scopes: Customer.Info, UserProfile.me

Grant Types: Authorization Code

Here is my curl command to get access token:

curl -i -H 'Authorization: Basic Y3VzdG9tZXJDbGllbnQ6dmY3NDBlTldWVDhGMGxoVw==' -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" –request POST http://ms.ap.com:14100/ms_oauth/oauth2/endpoints/oauthservice/tokens -d 'redirect_uri=http://ms.ap.com:7001/ClientWebApp/CustomerClient&grant_type=authorization_code&code=<auth_code>' -k

Below is the error I get:

{"error":"invalid_grant","error_description":"Invalid Grant: grant_type=authorization_code"}

Can someone please help me with this.

How this can be implemented for android app??

Not related to this but I am trying to implement the C2B use case of OAuth as provided in:

http://www.ateam-oracle.com/implementing-oauth-2-with-oracle-access-manager-oauth-services-part-iii/

Now I am able to get the authorization code from OAuth server but when I request for access_token I get invalid grant error. Here is my CustomerClient:

Client ID: customerClient

Client Secret: vf740eNWVT8F0lhW

HTTP Redirect URIs: http://ms.ap.com:7001/ClientWebApp/CustomerClient

Allowed Scopes: Customer.Info, UserProfile.me

Grant Types: Authorization Code

Here is my curl command to get access token:

curl -i -H 'Authorization: Basic Y3VzdG9tZXJDbGllbnQ6dmY3NDBlTldWVDhGMGxoVw==' -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" –request POST http://ms.ap.com:14100/ms_oauth/oauth2/endpoints/oauthservice/tokens -d 'redirect_uri=http://ms.ap.com:7001/ClientWebApp/CustomerClient&grant_type=authorization_code&code=<auth_code>' -k

Below is the error I get:

{"error":"invalid_grant","error_description":"Invalid Grant: grant_type=authorization_code"}

Can someone please help me with this.

Hi Manish, in my Curl command I've URL Encoded the redirect_uri. Not sure if this could be the reason for the error but you can give it a shot

Hi,

I have implemented this C2B Oauth.When I am trying to access the web url http://xxxx:7001/WebApplication/CustomerInfo

I am getting "The page isn't redirecting properly" in firefox.

Also when I am trying access the webservice http://xxxx:7001/xyz/rest/customer by using curl

I am getting

java.lang.RuntimeException: java.io.FileNotFoundException: Response: &#39;401: Unauthorized&#39; for url: &#39;http://oam.example.com:14100/ms_oauth/oauth2/endpoints/oauthservice/tokens&#39;

I am using following curl command

curl -i --request POST "http://xxxx:7001/xyz/rest/customer/" -d 'userID=userId&code=AuthToken'

Can someone please help me with this.

Superb...You are amazing.  Never came across such an wonderful article on OAuth and after seeing this,  I am so relaxed.

Hi,
I am also using same like curl -i --request POST "http://xxxx:7001/xyz/rest/customer/" -d 'userID=userId&code=AuthToken'
but I am getting 401 unauthorized error to access web service.

Thank you.