Scribe 和 Atlassian 休息答案

【问题标题】：Scribe and Atlassian restScribe 和 Atlassian 休息
【发布时间】：2013-01-02 18:46:26
【问题描述】：

我正在尝试使用 Scribe 来使用 Atlassian Jira，使用示例来自这里：

https://developer.atlassian.com/display/JIRADEV/JIRA+REST+API+Example+-+OAuth+authentication

谁有运气？

这是我得到的：

public class JiraAPI extends DefaultApi10a {

static final String BASE = "http://xasdf:8080/plugins/servlet";

 @Override
 public String getAccessTokenEndpoint()
 {
   return BASE + "/oauth/access-token";
 }

 @Override
 public String getAuthorizationUrl(Token requestToken)
 {
   return BASE + "/oauth/authorize?oauth_token="+requestToken.getToken();
 }

 @Override
 public String getRequestTokenEndpoint()
 {
   return BASE + "/oauth/request-token";
 }

 @Override
 public SignatureService getSignatureService() {
    return new RSASha1SignatureService(getPrivateKey());
 }

private static PrivateKey getPrivateKey()
  {
    String str = "MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAMPQ5BCMxlUq2TYy\n"+
                 "iRIoEUsz6HGTJhHuasS2nx1Se4Co3lxwxyubVdFj8AuhHNJSmJvjlpbTsGOjLZpr\n"+
                 "HyDEDdJmf1Fensh1MhUnBZ4a7uLrZrKzFHHJdamX9pxapB89vLeHlCot9hVXdrZH\n"+
                 "nNtg6FdmRKH/8gbs8iDyIayFvzYDAgMBAAECgYA+c9MpTBy9cQsR9BAvkEPjvkx2\n"+
                 "XL4ZnfbDgpNA4Nuu7yzsQrPjPomiXMNkkiAFHH67yVxwAlgRjyuuQlgNNTpKvyQt\n"+
                 "XcHxffnU0820VmE23M+L7jg2TlB3+rUnEDmDvCoyjlwGDR6lNb7t7Fgg2iR+iaov\n"+
                 "0iVzz+l9w0slRlyGsQJBAPWXW2m3NmFgqfDxtw8fsKC2y8o17/cnPjozRGtWb8LQ\n"+
                 "g3VCb8kbOFHOYNGazq3M7+wD1qILF2h/HecgK9eQrZ0CQQDMHXoJMfKKbrFrTKgE\n"+
                 "zyggO1gtuT5OXYeFewMEb5AbDI2FfSc2YP7SHij8iQ2HdukBrbTmi6qxh3HmIR58\n"+
                 "I/AfAkEA0Y9vr0tombsUB8cZv0v5OYoBZvCTbMANtzfb4AOHpiKqqbohDOevLQ7/\n"+
                 "SpvgVCmVaDz2PptcRAyEBZ5MCssneQJAB2pmvaDH7Ambfod5bztLfOhLCtY5EkXJ\n"+
                 "n6rZcDbRaHorRhdG7m3VtDKOUKZ2DF7glkQGV33phKukErVPUzlHBwJAScD9TqaG\n"+
                 "wJ3juUsVtujV23SnH43iMggXT7m82STpPGam1hPfmqu2Z0niePFo927ogQ7H1EMJ\n"+
                 "UHgqXmuvk2X/Ww==";

    try
    {
      KeyFactory fac = KeyFactory.getInstance("RSA");
      PKCS8EncodedKeySpec privKeySpec = new PKCS8EncodedKeySpec(Base64.decodeBase64(str.getBytes()));
      return fac.generatePrivate(privKeySpec);
    }
    catch (Exception e)
    {
      throw new RuntimeException(e);
    }
  }
}

Scribe 一直很容易与其他基于 OAuth 的提供程序一起使用，但此提供程序在调试时总是“oauth_problem=signature_invalid”：

正在生成签名... 基底线是：POST＆HTTP％3A％2F％2Fxasdf％3A8080％2Fplugins％2Fservlet％2Foauth％2Frequest令牌＆oauth_callback％3Doob％26oauth_consumer_key％3Dhardcoded消费者％26oauth_nonce％3D1556398454％26oauth_signature_method％3DRSA-SHA1％26oauth_timestamp％3D1357151719％26oauth_version％3D1。 0 签名是：AJugUeZGup5dZvjNjx6bec6OrAszZVK + pMrTzahZbbzKzGkbli7okBy2KO5ww + OtqqnHWRgyzfWnQ0k6R5U0JzjR4QiOANJuwV8Un1NTZsrK32daefCp2uZ6W2d2Y / fmIl3toyCjAx41c3oJ78572vVFmBGihHUTUOYTlFP1X3M = 所附额外的OAuth参数：{oauth_callback - > OOB，oauth_signature - > AJugUeZGup5dZvjNjx6bec6OrAszZVK + pMrTzahZbbzKzGkbli7okBy2KO5ww + OtqqnHWRgyzfWnQ0k6R5U0JzjR4QiOANJuwV8Un1NTZsrK32daefCp2uZ6W2d2Y / fmIl3toyCjAx41c3oJ78572vVFmBGihHUTUOYTlFP1X3M =，oauth_version - > 1.0，oauth_nonce - > 1556398454，oauth_signature_method - > RSA-SHA1，oauth_consumer_key - >硬编码消费，oauth_timestamp - > 1357151719 }

使用 Http Header 签名发送请求... 响应状态码：401

线程“主”org.scribe.exceptions.OAuthException 中的异常：响应正文不正确。不能提取此令牌和成功秘诀：“oauth_signature = AJugUeZGup5dZvjNjx6bec6OrAszZVK％2BpMrTzahZbbzKzGkbli7okBy2KO5ww％2BOtqqnHWRgyzfWnQ0k6R5U0JzjR4QiOANJuwV8Un1NTZsrK32daefCp2uZ6W2d2Y％2FfmIl3toyCjAx41c3oJ78572vVFmBGihHUTUOYTlFP1X3M％3D＆oauth_signature_base_string = POST％26http％253A％252F％252Ftracker％253A8080％252Fplugins％252Fservlet％252Foauth％252Frequest令牌％26oauth_callback％253Doob％2526oauth_consumer_key %253Dhardcoded-consumer%2526oauth_nonce%253D1556398454%2526oauth_signature_method%253DRSA-SHA1%2526oauth_timestamp%253D1357151719%2526oauth_version%253D1.0&oauth_problem=signature_invalid&oauth_sign 响应身体：oauth_signature = AJugUeZGup5dZvjNjx6bec6OrAszZVK％2BpMrTzahZbbzKzGkbli7okBy2KO5ww％2BOtqqnHWRgyzfWnQ0k6R5U0JzjR4QiOANJuwV8Un1NTZsrK32daefCp2uZ6W2d2Y％2FfmIl3toyCjAx41c3oJ78572vVFmBGihHUTUOYTlFP1X3M％3D＆oauth_signature_base_string = POST％26http％253A％252F％252Ftracker％253A8080％252Fplugins％252Fservlet％252Foauth％252Frequest令牌％26oauth_callback％253Doob％2526oauth_consumer_key％253Dhardcoded消费者％2526oauth_nonce％253D1556398454 %2526oauth_signature_method%253DRSA-SHA1%2526oauth_timestamp%253D1357151719%2526oauth_version%253D1.0&oauth_problem=signature_invalid&oauth_signature_method=RSA-SHA1 在 org.scribe.extractors.TokenExtractorImpl.extract(TokenExtractorImpl.java:41)

【问题讨论】：

你解决了吗？

标签： scribe

【解决方案1】：

据我所知，您不能将 Scribe 与 JIRA/Atlassian OAuth 一起使用，因为 Scribe 不支持 RSA-SHA1 签名，但这是 Atlassian 的 OAuth 提供程序中唯一可用的签名。

我能找到的唯一支持此方法的 Java 库是问题中链接的示例代码中使用的那个 - net.oauth 之一。

【讨论】：

【解决方案2】：

我使用提供的RSASha1SignatureService 使用 scribe 1.3.6 进行这项工作，这是我提取私钥的方式（从 PKCS#8 PEM 文件，带有 BEGIN PRIVATE KEY 标头的文件，而不是 @987654323 @，即 SSLeay 格式）

package com.company.client.api;

import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;

import org.scribe.builder.api.DefaultApi10a;
import org.scribe.builder.api.DefaultApi20;
import org.scribe.model.OAuthConfig;
import org.scribe.model.Token;
import org.scribe.services.RSASha1SignatureService;
import org.scribe.services.SignatureService;

public class JiraApi extends DefaultApi10a {

    private static final String AUTHORIZE_URL = "http://localhost:8080/plugins/servlet/oauth/authorize?oauth_token=%s";
    private static final String REQUEST_TOKEN_RESOURCE = "http://localhost:8080/plugins/servlet/oauth/request-token";
    private static final String ACCESS_TOKEN_RESOURCE = "http://localhost:8080/plugins/servlet/oauth/access-token";

    @Override
    public String getAccessTokenEndpoint() {
        return ACCESS_TOKEN_RESOURCE;
    }

    @Override
    public String getRequestTokenEndpoint() {
        return REQUEST_TOKEN_RESOURCE;
    }

    @Override
    public String getAuthorizationUrl(Token requestToken) {
        return String.format(AUTHORIZE_URL, requestToken.getToken());
    }

    @Override
    public SignatureService getSignatureService() {
        return new RSASha1SignatureService(getPrivateKey());
    }

    private PrivateKey getPrivateKey() {
        try {
            byte[] key = Base64.getDecoder().decode(JiraClientImpl.privateKey); // this is the PEM encoded PKCS#8 private key 
            PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(key);
            KeyFactory kf = KeyFactory.getInstance("RSA");
            return kf.generatePrivate(keySpec);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

}

【讨论】：