import net.oauth.OAuthMessage; //导入依赖的package包/类
private OAuthMessage createLaunchParameters(String consumerKey, String secret, String url, String bodyHash)
{
	final String nonce = UUID.randomUUID().toString();
	final String timestamp = Long.toString(TimeUnit.MILLISECONDS.toSeconds(System.currentTimeMillis()));

	final OAuthMessage message = new OAuthMessage(OAuthMessage.POST, url, null);
	message.addParameter(OAuth.OAUTH_CONSUMER_KEY, consumerKey);
	message.addParameter(OAuth.OAUTH_SIGNATURE_METHOD, OAuth.HMAC_SHA1);
	message.addParameter(OAuth.OAUTH_NONCE, nonce);
	message.addParameter(OAuth.OAUTH_TIMESTAMP, timestamp);
	message.addParameter("oauth_body_hash", bodyHash);

	final OAuthConsumer consumer = new OAuthConsumer(null, consumerKey, secret, null);
	final OAuthAccessor accessor = new OAuthAccessor(consumer);
	try
	{
		message.sign(accessor);
		return message;
	}
	catch( Exception e )
	{
		throw new RuntimeException(e);
	}
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
@Override
public void sendGrade(ImsxPOXEnvelopeType envelope, String consumerKey, String secret, String url,
	HttpServletResponse servletResponse)
{
	if( url != null )
	{
		try
		{
			final Request req = createLtiOutcomesRequest(envelope, url, consumerKey, secret);
			try( Response httpResp = httpService.getWebContent(req, configService.getProxyDetails()) )
			{
				parseError(httpResp, url);
				String respBody = httpResp.getBody();
				final String bodyHash = calcSha1Hash(respBody);
				final OAuthMessage message = createLaunchParameters(consumerKey, secret, url, bodyHash);

				servletResponse.addHeader("Authorization", message.getAuthorizationHeader(""));
				CharStreams.copy(new StringReader(httpResp.getBody()), servletResponse.getWriter());
			}
		}
		catch( Exception e )
		{
			throw Throwables.propagate(e);
		}
	}
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
private Request createLtiOutcomesRequest(ImsxPOXEnvelopeType imsxEnvelope, String url, String consumerKey,
	String consumerSecret) throws Exception
{
	final Request webRequest = new Request(url);
	webRequest.setMethod(Method.POST);
	webRequest.setMimeType("application/xml");

	final ObjectFactory of = new ObjectFactory();
	final JAXBElement<ImsxPOXEnvelopeType> createImsxPOXEnvelopeRequest = of
		.createImsxPOXEnvelopeRequest(imsxEnvelope);

	final JAXBContext jc = JAXBContext.newInstance("com.tle.web.lti.imsx", LtiServiceImpl.class.getClassLoader());
	final Marshaller marshaller = jc.createMarshaller();
	marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);

	final StringWriter sw = new StringWriter();
	marshaller.marshal(createImsxPOXEnvelopeRequest, sw);
	webRequest.setBody(sw.toString());

	final String bodyHash = calcSha1Hash(webRequest.getBody());
	final OAuthMessage message = createLaunchParameters(consumerKey, consumerSecret, url, bodyHash);
	webRequest.addHeader("Authorization", message.getAuthorizationHeader(""));
	return webRequest;
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
/**
 * Check whether the message has a valid signature.
 * @throws URISyntaxException 
 *
 * @throws OAuthProblemException
 *             the signature is invalid
 */
public void validate(OAuthMessage message)
throws IOException, OAuthException, URISyntaxException {
    message.requireParameters("oauth_signature");
    String signature = message.getSignature();
    String baseString = getBaseString(message);
    if (!isValid(signature, baseString)) {

 // *LAMS* added by LAMS
 log.debug("Error. Signature invalid. oauth_signature=" + signature + ", oauth_signature_base_string="
  + baseString + ", oauth_signature_method=" + message.getSignatureMethod());
     		
        OAuthProblemException problem = new OAuthProblemException(
                "signature_invalid");
        problem.setParameter("oauth_signature", signature);
        problem.setParameter("oauth_signature_base_string", baseString);
        problem.setParameter("oauth_signature_method", message
                .getSignatureMethod());
        throw problem;
    }
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
public static String getBaseString(OAuthMessage message)
        throws IOException, URISyntaxException {
    List<Map.Entry<String, String>> parameters;
    String url = message.URL;
    int q = url.indexOf('?');
    if (q < 0) {
        parameters = message.getParameters();
    } else {
        // Combine the URL query string with the other parameters:
        parameters = new ArrayList<Map.Entry<String, String>>();
        parameters.addAll(OAuth.decodeForm(message.URL.substring(q + 1)));
        parameters.addAll(message.getParameters());
        url = url.substring(0, q);
    }
    return OAuth.percentEncode(message.method.toUpperCase()) + '&'
            + OAuth.percentEncode(normalizeUrl(url)) + '&'
            + OAuth.percentEncode(normalizeParameters(parameters));
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
@Override
public Map<String, String> signParameters(Map<String, String> parameters, String key, String secret, String url, String method) throws LtiSigningException {
    OAuthMessage oam = new OAuthMessage(method, url, parameters.entrySet());
    OAuthConsumer cons = new OAuthConsumer(null, key, secret, null);
    OAuthAccessor acc = new OAuthAccessor(cons);
    try {
        oam.addRequiredParameters(acc);

        Map<String, String> signedParameters = new HashMap<>();
        for(Map.Entry<String, String> param : oam.getParameters()){
            signedParameters.put(param.getKey(), param.getValue());
        }
        return signedParameters;
    } catch (OAuthException |IOException |URISyntaxException e) {
        throw new LtiSigningException("Error signing LTI request.", e);
    }
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
public static List<OAuth.Parameter> getParameters(HttpServletRequest request) {
    List<OAuth.Parameter> list = new ArrayList<OAuth.Parameter>();
    for (Enumeration<String> headers = request.getHeaders("Authorization"); headers != null
            && headers.hasMoreElements();) {
        String header = headers.nextElement();
        for (OAuth.Parameter parameter : OAuthMessage
                .decodeAuthorization(header)) {
            if (!"realm".equalsIgnoreCase(parameter.getKey())) {
                list.add(parameter);
            }
        }
    }
    for (Object e : request.getParameterMap().entrySet()) {
        Map.Entry<String, String[]> entry = (Map.Entry<String, String[]>) e;
        String name = entry.getKey();
        for (String value : entry.getValue()) {
            list.add(new OAuth.Parameter(name, value));
        }
    }
    return list;
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
public static void handleException(HttpServletResponse response,
        Exception e, String realm, boolean sendBody) throws IOException,
        ServletException {
    if (e instanceof OAuthProblemException) {
        OAuthProblemException problem = (OAuthProblemException) e;
        Object httpCode = problem.getParameters().get(OAuthProblemException.HTTP_STATUS_CODE);
        if (httpCode == null) {
            httpCode = PROBLEM_TO_HTTP_CODE.get(problem.getProblem());
        }
        if (httpCode == null) {
            httpCode = SC_FORBIDDEN;
        }
        response.reset();
        response.setStatus(Integer.parseInt(httpCode.toString()));
        OAuthMessage message = new OAuthMessage(null, null, problem
                .getParameters().entrySet());
        response.addHeader("WWW-Authenticate", message
                .getAuthorizationHeader(realm));
        if (sendBody) {
            sendForm(response, message.getParameters());
        }
    } else if (e instanceof IOException) {
        throw (IOException) e;
    } else if (e instanceof ServletException) {
        throw (ServletException) e;
    } else if (e instanceof RuntimeException) {
        throw (RuntimeException) e;
    } else {
        throw new ServletException(e);
    }
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
/**
 * Do a http get for the given url.
 *
 * @param url requested url
 * @param parameters request parameters
 * @param accessor oauth accessor
 * @return the http response
 * @throws IOException
 * @throws {@link YNoteException}
 */
public static HttpResponse doGet(String url, Map<String, String> parameters,
        OAuthAccessor accessor) throws IOException, YNoteException {
    // add ynote parameters to the url
    OAuth.addParameters(url, parameters == null ? null : parameters.entrySet());
    HttpGet get = new HttpGet(url);
    // sign all parameters, including oauth parameters and ynote parameters
    // and add the oauth related information into the header        
    Header oauthHeader = getAuthorizationHeader(url, OAuthMessage.GET,
            parameters, accessor);
    get.addHeader(oauthHeader);
    HttpParams params = new BasicHttpParams();
    HttpClientParams.setRedirecting(params, false);
    get.setParams(params);
    HttpResponse response = client.execute(get);
    if ((response.getStatusLine().getStatusCode() / 100) != 2) {
        YNoteException e = wrapYNoteException(response);
        throw e;
    }
    return response;
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
/**
 * Do a http post with url encoded content type.
 *
 * @param url
 * @param formParams
 * @param accessor
 * @return
 * @throws IOException
 * @throws YNoteException
 */
public static HttpResponse doPostByUrlEncoded(String url,
        Map<String, String> formParams, OAuthAccessor accessor)
        throws IOException, YNoteException {
    HttpPost post = new HttpPost(url);
    // for url encoded post, sign all the parameters, including oauth
    // parameters and form parameters
    Header oauthHeader = getAuthorizationHeader(url, OAuthMessage.POST,
            formParams, accessor);
    if (formParams != null) {
        // encode our ynote parameters
        List<NameValuePair> pairs = new ArrayList<NameValuePair>();
        for(Entry<String, String> entry : formParams.entrySet()) {
            pairs.add(new BasicNameValuePair(entry.getKey(), entry.getValue()));
        }
        UrlEncodedFormEntity entity = new UrlEncodedFormEntity(pairs, YNoteConstants.ENCODING);
        post.setEntity(entity);
    }
    post.addHeader(oauthHeader);
    HttpResponse response = client.execute(post);
    if ((response.getStatusLine().getStatusCode() / 100) != 2) {
        YNoteException e = wrapYNoteException(response);
        throw e;
    }
    return response;
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
private ParticipantId validateAndAuthorize(HttpServletRequest req, HttpServletResponse resp) throws IOException {
  OAuthMessage message = new HttpRequestMessage(req, req.getRequestURL().toString());

  OAuthAccessor accessor;
  try {
    message.requireParameters(OAuth.OAUTH_TOKEN);
    accessor = tokenContainer.getAccessTokenAccessor(message.getParameter(OAuth.OAUTH_TOKEN));
  } catch (OAuthProblemException e) {
    LOG.info("No valid OAuth token present", e);
    // Have to set status here manually, cannot use e.getHttpStatusCode
    // because message.requireParameters doesn't set it in the exception.
    resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, e.getMessage());
    return null;
  }
  if (!validateMessage(req, accessor)) {
    resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    return null;
  }
  return (ParticipantId) accessor.getProperty(DataApiTokenContainer.USER_PROPERTY_NAME);
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
public void testDoPostExecutesAndWritesResponse() throws Exception {
  String operationId = "op1";
  OperationRequest operation = new OperationRequest("wavelet.create", operationId);
  List<OperationRequest> operations = Collections.singletonList(operation);
  when(robotSerializer.deserializeOperations(anyString())).thenReturn(operations);
  String responseValue = "response value";
  when(robotSerializer.serialize(any(), any(Type.class), any(ProtocolVersion.class))).thenReturn(
      responseValue);
  Map<String, String[]> params = getOAuthParams();
  when(req.getParameterMap()).thenReturn(params);

  OperationService service = mock(OperationService.class);
  when(operationRegistry.getServiceFor(any(OperationType.class))).thenReturn(service);

  servlet.doPost(req, resp);

  verify(validator).validateMessage(any(OAuthMessage.class), any(OAuthAccessor.class));
  verify(operationRegistry).getServiceFor(any(OperationType.class));
  verify(service).execute(eq(operation), any(OperationContext.class), eq(ALEX));
  verify(resp).setStatus(HttpServletResponse.SC_OK);
  assertEquals("Response should have been written into the servlet", responseValue,
      stringWriter.toString());
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
public void testDoRequestToken() throws Exception {
  when(req.getPathInfo()).thenReturn(REQUEST_TOKEN_PATH);
  when(req.getMethod()).thenReturn("GET");

  servlet.doGet(req, resp);

  verify(resp).setStatus(HttpServletResponse.SC_OK);
  verify(validator).validateMessage(any(OAuthMessage.class), any(OAuthAccessor.class));
  assertTrue(outputStream.isClosed());

  // Verify that the output contains a token and token secret.
  String output = outputStream.toString();
  Map<String, String> parameters = toMap(OAuth.decodeForm(output));
  assertTrue("Request token should be present", parameters.containsKey(OAuth.OAUTH_TOKEN));
  assertTrue(
      "Request token secret should be present", parameters.containsKey(OAuth.OAUTH_TOKEN_SECRET));
  OAuthAccessor requestTokenAccessor =
      tokenContainer.getRequestTokenAccessor(parameters.get(OAuth.OAUTH_TOKEN));
  assertNotNull("Container should have stored the token", requestTokenAccessor);
  assertEquals("Correct secret should be returned", requestTokenAccessor.tokenSecret,
      parameters.get(OAuth.OAUTH_TOKEN_SECRET));
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
public void testDoExchangeToken() throws Exception {
  when(req.getPathInfo()).thenReturn(ACCESS_TOKEN_PATH);
  when(req.getMethod()).thenReturn("GET");
  Map<String, String[]> params = getDoExchangeTokenParams();
  when(req.getParameterMap()).thenReturn(params);

  servlet.doGet(req, resp);

  verify(validator).validateMessage(any(OAuthMessage.class), any(OAuthAccessor.class));
  verify(resp).setStatus(HttpServletResponse.SC_OK);

  // Verify that the output contains a token and token secret.
  String output = outputStream.toString();
  Map<String, String> parameters = toMap(OAuth.decodeForm(output));
  assertTrue("Access token should be present", parameters.containsKey(OAuth.OAUTH_TOKEN));
  assertTrue(
      "Access token secret should be present", parameters.containsKey(OAuth.OAUTH_TOKEN_SECRET));
  OAuthAccessor accessTokenAccessor =
      tokenContainer.getAccessTokenAccessor(parameters.get(OAuth.OAUTH_TOKEN));
  assertNotNull("Container should have stored the token", accessTokenAccessor);
  assertEquals("Correct secret should be returned", accessTokenAccessor.tokenSecret,
      parameters.get(OAuth.OAUTH_TOKEN_SECRET));
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
/** 
        * getOAuthURL - Form a GET request signed by OAuth
 * @param method
 * @param url
 * @param oauth_consumer_key
 * @param oauth_consumer_secret
 * @param signature
 */
public static String getOAuthURL(String method, String url, 
	String oauth_consumer_key, String oauth_secret, String signature)
{
	OAuthMessage om = new OAuthMessage(method, url, null);
	om.addParameter(OAuth.OAUTH_CONSUMER_KEY, oauth_consumer_key);
	if ( signature == null ) signature = OAuth.HMAC_SHA1;
	om.addParameter(OAuth.OAUTH_SIGNATURE_METHOD, signature);
	om.addParameter(OAuth.OAUTH_VERSION, "1.0");
	om.addParameter(OAuth.OAUTH_TIMESTAMP, new Long((new Date().getTime()) / 1000).toString());
	om.addParameter(OAuth.OAUTH_NONCE, UUID.randomUUID().toString());

	OAuthConsumer oc = new OAuthConsumer(null, oauth_consumer_key, oauth_secret, null);
	try {
	    OAuthSignatureMethod osm = OAuthSignatureMethod.newMethod(signature, new OAuthAccessor(oc));
	    osm.sign(om);
	    url = OAuth.addParameters(url, om.getParameters());
	    return url;
	} catch (Exception e) {
		log.error(e.getMessage(), e);
		return null;
	}
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
/**
    * Get an access token from the service provider, in exchange for an
    * authorized request token.
    * 
    * @param accessor
    *            should contain a non-null requestToken and tokenSecret, and a
    *            consumer that contains a consumerKey and consumerSecret. Also,
    *            accessor.consumer.serviceProvider.accessTokenURL should be the
    *            URL (determined by the service provider) for getting an access
    *            token.
    * @param httpMethod
    *            typically OAuthMessage.POST or OAuthMessage.GET, or null to
    *            use the default method.
    * @param parameters
    *            additional parameters for this request, or null to indicate
    *            that there are no additional parameters.
    * @throws OAuthProblemException
    *             the HTTP response status code was not 200 (OK)
    */
   @SuppressWarnings("rawtypes")
public OAuthMessage getAccessToken(OAuthAccessor accessor, String httpMethod,
           Collection<? extends Map.Entry> parameters) throws IOException, OAuthException, URISyntaxException {
       if (accessor.requestToken != null) {
           if (parameters == null) {
               parameters = OAuth.newList(OAuth.OAUTH_TOKEN, accessor.requestToken);
           } else if (!OAuth.newMap(parameters).containsKey(OAuth.OAUTH_TOKEN)) {
               List<Map.Entry> p = new ArrayList<Map.Entry>(parameters);
               p.add(new OAuth.Parameter(OAuth.OAUTH_TOKEN, accessor.requestToken));
               parameters = p;
           }
       }
       OAuthMessage response = invoke(accessor, httpMethod,
               accessor.consumer.serviceProvider.accessTokenURL, parameters);
       response.requireParameters(OAuth.OAUTH_TOKEN, OAuth.OAUTH_TOKEN_SECRET);
       accessor.accessToken = response.getParameter(OAuth.OAUTH_TOKEN);
       accessor.tokenSecret = response.getParameter(OAuth.OAUTH_TOKEN_SECRET);
       return response;
   }
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
@SuppressWarnings("unchecked")
public static List<OAuth.Parameter> getParameters(HttpServletRequest request) {
       List<OAuth.Parameter> list = new ArrayList<OAuth.Parameter>();
       for (Enumeration<String> headers = request.getHeaders("Authorization"); headers != null
               && headers.hasMoreElements();) {
           String header = headers.nextElement();
           for (OAuth.Parameter parameter : OAuthMessage
                   .decodeAuthorization(header)) {
               if (!"realm".equalsIgnoreCase(parameter.getKey())) {
                   list.add(parameter);
               }
           }
       }
       for (Object e : request.getParameterMap().entrySet()) {
           Map.Entry<String, String[]> entry = (Map.Entry<String, String[]>) e;
           String name = entry.getKey();
           for (String value : entry.getValue()) {
               list.add(new OAuth.Parameter(name, value));
           }
       }
       return list;
   }
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
@Override
public String authenticate(HttpServletRequest request) throws IOException, OAuthException,
    URISyntaxException {
  OAuthMessage message = OAuthServlet.getMessage(request, null);

  // Retrieve and set the user info with the OAuth parameters
  Map<UserInfoProperties, Object> oauthParams = new HashMap<UserInfoProperties, Object>();
  oauthParams.put(UserInfoProperties.EMAIL,
      urlDecode(message.getParameter("opensocial_viewer_id")));
  oauthParams.put(UserInfoProperties.VIEWER_ID,
      urlDecode(message.getParameter("opensocial_viewer_id")));
  oauthParams.put(UserInfoProperties.OWNER_EMAIL,
      urlDecode(message.getParameter("opensocial_owner_id")));
  oauthParams.put(UserInfoProperties.OWNER_ID,
      urlDecode(message.getParameter("opensocial_owner_id")));
  oauthParams.put(UserInfoProperties.APPLICATION_ID, message.getParameter("opensocial_app_id"));
  oauthParams.put(UserInfoProperties.APPLICATION_URL, message.getParameter("opensocial_app_url"));

  UserInfo userInfo = new HashMapBasedUserInfo(oauthParams);
  request.setAttribute(AbstractManagedCollectionAdapter.USER_INFO, userInfo);

  return message.getParameter("opensocial_viewer_id");
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
public static PartnerSessionRequest generatePartnerSessionRequest(String consumerKey, String consumerSecret, Integer userId, Integer corporationId) throws Exception {
	PartnerSessionRequest request = new PartnerSessionRequest();
	
	request.setOauthConsumerKey(consumerKey);
	request.setUserId(userId);
	request.setCorporationId(corporationId);

	Map<String, String> params = new HashMap<String, String>();
	params.put(USER_ID, String.valueOf(userId));
	params.put(CORPORATION_ID, String.valueOf(corporationId));

	OAuthMessage message = buildOauthMessage(consumerKey, consumerSecret, SCOPE, params);
	
	request.setOauthSignatureMethod(message.getSignatureMethod());
	request.setOauthSignature(message.getSignature());
	request.setOauthNonce(message.getParameter(OAuth.OAUTH_NONCE));
	request.setOauthTimeStamp(message.getParameter(OAuth.OAUTH_TIMESTAMP));
	request.setOauthVersion(message.getParameter(OAuth.OAUTH_VERSION));

	return request;
}
 

import net.oauth.OAuthMessage; //导入依赖的package包/类
/**
 * Check whether the message has a valid signature.
 * @throws URISyntaxException 
 *
 * @throws OAuthProblemException
 *             the signature is invalid
 */
public void validate(OAuthMessage message)
throws IOException, OAuthException, URISyntaxException {
    message.requireParameters("oauth_signature");
    String signature = message.getSignature();
    String baseString = getBaseString(message);
    if (!isValid(signature, baseString)) {
        OAuthProblemException problem = new OAuthProblemException(
                "signature_invalid");
        problem.setParameter("oauth_signature", signature);
        problem.setParameter("oauth_signature_base_string", baseString);
        problem.setParameter("oauth_signature_method", message
                .getSignatureMethod());
        throw problem;
    }
}