Develop Reference

SAML token based authentication for consuming share point 2013 rest web services from JAVA/J2ee application

I have a java/j2ee web application consuming SP web services but recently the SP site got migrated to 2013 and deployed in cloud/office 0365 due to which authentication got broken. SP people suggested to change authentication mechanism to SAML token based authentication and use Microsoft Azure AD. So i on boarded my application into Azure and received Client ID, Authority using which i am able to generate security token(used adal4j java api) . Now i need to complete below 2 steps to complete the authentication process in office 0365 to access SP 2013 web services.
Get access token cookies
Get request digest token
But not able to find any java based API for above 2 steps. Refereed below tutorial buts its something related to aps/.net
http://paulryan.com.au/2014/spo-remote-authentication-rest/
Please help me in providing sample code base for the same.
Appreciate your support

So you used Microsoft Azure Active Directory Authentication Library (ADAL) for Java?
In which case, have a look at AAD Java samples.
You want the ones that consume a Web API.

Per my experience, I think you can try to directly follow your refered article step by step to use the Apache HttpClient to construct the request.
For example, the code below is using the HttpClient to do the post request with the xml body to get the security token.
CloseableHttpClient httpclient = HttpClients.createDefault();
HttpPost httpPost = new HttpPost("https://login.microsoftonline.com/extSTS.srf");
String xmlBody = "...";
InputStreamEntity reqEntity = new InputStreamEntity(
new ByteArrayInputStream(xmlBody.getBytes(), -1, ContentType.APPLICATION_OCTET_STREAM);
reqEntity.setChunked(true);
httpPost.addHeader("Accept", "application/json; odata=verbose")
httpPost.setEntity(reqEntity);
CloseableHttpResponse response = httpclient.execute(httppost);
String respXmlBody = EntityUtils.toString(response.getEntity());
//Parse the respXmlBody and extract the security token
You can try to follow the code above to get the response includes access token via do the post request with the security token body for the url https://yourdomain.sharepoint.com/_forms/default.aspx?wa=wsignin1.0, and use the code Header[] hs = response.getHeaders("Set-Cookie"); to get the Set-Cookie header array as access token.
Then using them to set the two headers Cookie for getting the request digest token, and parse the response body to extract the FormDigestValue as the request digest token.

How does cookies work, when calling cookie-setting REST services from java VM?

I'm in the process of learning how to use HP Quality Center's REST api to query and manipulate data. Unlike REST standard, this API is not completely stateless. It uses cookies to store authentication sessions.
I've tried to implement a very simple test, using the Jersey Client library. I can successfully authenticate my user, by sending my credentials. The API reference claims that this will set a cookie, and I am good to go with further calling the REST api. However, a simple "is-authenticated" call returns a 401, Authentication failed.
I have a feeling that the cookie writing or reading is not working properly, as everything else seems to work as it should. But I haven't been able to find out if or how cookies are set and read, when no browser is involved. So How does cookies work, when calling cookie-setting REST services from java VM? Does it work at all? Where are they stored?
I am using Eclipse Kepler as my IDE, if that matters at all, and a 32-bit java 1.6 JDK and JRE.
Code, and response strings below:
1. Logging in:
Client client = ClientBuilder.newClient();
Response response = client
.target("http://[host]:[port]").path("qcbin/authentication-
point/alm-authenticate")
.request().post(Entity.entity("<alm-authentication>
<user>username</user>
<password>secret</password></alm-authentication>",
MediaType.TEXT_XML_TYPE));
System.out.println(response.toString());
Output:
InboundJaxrsResponse{ClientResponse{method=POST,
uri=http://[host]:[port]/qcbin/authentication-point/alm-authenticate,
status=200, reason=OK}}
API Return description:
One of:
HTTP code 200 and sets the LWSSO cookie (LWSSO_COOKIE_KEY).
HTTP code 401 for non-authenticated request. Sends header
WWW-Authenticate: ALMAUTH
2. Verifying Logged in:
response = client.target("http://[host]:[port]")
.path("qcbin/rest/is-authenticated")
.request().get();
System.out.println(response.toString());
Output:
InboundJaxrsResponse{ClientResponse{method=GET,
uri=http://[host]:[port]/rest/is-authenticated, status=401,
reason=Authentication failed. Browser based integrations - to login append
'?login-form-required=y to the url you tried to access.}}
PS: adding the ?login-form-required=y to the URL, will bring up a log-in window when called in a browser, but not here. Appending the line to the URL actually still gives the same error message, and suggestion to append it again. Also, when called in a browser, the is-authenticated returns a 200, success, even without the login-form.

When you log in, you're getting a cookie which is a name plus a value.
The REST server expects you to pass this in the request header with every request you make.
Look into the object which you get for client.request(); there should be a way to specify additional headers to send to the server. The header name must be Cookie and the header value must be name=value.
So if the server responds with a cookie called sessionID with the value 1234, then you need something like:
client.request().header("Cookie", "sessionID=1234")
Related:
http://en.wikipedia.org/wiki/HTTP_cookie

Send xml as part of URL request in Java

This might be a trivial question but I'm trying to send web request to USPS to get a http post response (or email response depending on my request) containing the tracking information based on the tracking number that I send in. The documentation says the xml needs to appended as part of the url like below
http://secure.shippingapis.com/ShippingAPITest.dll?API=TrackV2&XML=<PTSEmailRequest USERID="xxxxx"><TrackId>xxxxx</TrackId><RequestType>EN</RequestType></PTSEmailRequest>
I saw there were 2 ways to make an xml request, one using HttpPost and the other URLConnection. I'm a bit thrown by how I go about this and I'm failing to appreciate what's the difference between appending xml in the url and a normal http request. Can someone please clear things up for me?
USPS documentation for tracking =>
https://www.usps.com/business/web-tools-apis/track-and-confirm.pdf
I read these related Stackoverflow posts
Java: How to send a XML request?
posting XML request in java
HttpClient httpclient = HttpClients.createDefault();
HttpPost httppost = new HttpPost("http://secure.shippingapis.com/ShippingAPITest.dll");
List<String> params = new ArrayList<String>(2);
params.add(new BasicNameValuePair("API", "TrackV2"));
params.add(new BasicNameValuePair("XML", FuncTOGenerateXML()));
httppost.setEntity(new UrlEncodedFormEntity(params, "UTF-8"));
HttpResponse response = httpclient.execute(httppost);
HttpEntity entity = response.getEntity();
if (entity != null) {
InputStream instream = entity.getContent();
//.....
// .....
instream.close();
}

An HTTP request can use one of several methods, like POST, GET, DELETE, PUT... Here we talk about POST and GET
Technical differences
With GET, the data is retrieved from the parameters in the URL.
With POST, the data is retrieved from the data transmitted inside the HTTP message.
Intended use differences
GET is intended to be used when the request does not cause a change (v.g., searching in Google). Since you can repeat the request without side effects, the data is in the URL and can be stored in the browser history, favorites, etc.
POST is intended to use when you are performing a change (v.g. sending an e-mail, doing a on-line purchase). The data related is not stored with the URL (it is then that, if you go back to a page that was obtained using POST, the browser many times will show you a pop-up asking for permission to send the data again.
In real usage, the distinction is not so clear cut, in particular POST is sometimes used when the data is too large (URLs have limited length). Also, sometimes GET is used with the meaning of POST so the data can be presented as an HTML link.
Finally, URLConnection is the basic API for opening a connection (which you can use as a POST or GET request, based in how you pass the data, or something else) and HttpPost is just a higher level API for creating a POST request. If you go the basic way, use HttpURLConnection better.

How can I access a 'Web App' built in Google Apps Script from Android?

I can successfully access Google Drive and Spreadsheet functionality from my application.
So I have an authorised instance of com.google.api.client.auth.oauth2.Credential.
Now I wish to execute a Google Apps Script that is deployed as a 'Web App'. This will also require authentication to run. This script runs in the browser if I hit the endpoint and am authenticated.
Here's some psuedo code :
String url = "https://script.google.com/a/macros/mycompany.com/s/xxxx/dev";
GenericUrl webAppEndPoint = new GenericUrl(url);
final HttpTransport httpTransport = AndroidHttp.newCompatibleTransport();
HttpRequestFactory requestFactory = httpTransport.createRequestFactory(currentCredential);
// Do POST for service
String requestBody = URLEncoder.encode("{\"name\":\"John Smith\",\"company\":\"Virginia Company\",\"pdf\":\""+getPdfBase64()+"\"}", "UTF-8");
HttpRequest postRequest =requestFactory.buildPostRequest(new GenericUrl(url), ByteArrayContent.fromString(null, requestBody));
postRequest.getHeaders().setAccept("application/json");
postRequest.setFollowRedirects(true);
postRequest.setLoggingEnabled(true);
HttpResponse postResponse = postRequest.execute();
If I run the code I get the following error : com.google.api.client.http.HttpResponseException: HttpResponseException 405 Method Not Allowed
UPDATE : So - originally i was POSTing to the wrong URL ( i'd copied the redirected URL from a browser instead of the script URL )
The POST is now successful ( authentication included ) using the above code, but it still doesn't handle the GET redirect after submission. I can work with this now but it would be good to be able to get a response from the server.
I think that com.google.api.client.http.HttpRequest doesn't handle authenticated POST redirects properly.

Your pseudocode isn’t very illuminating; to really see what’s going on you’d need to show the actual HTTP traffic. I should say though that a 302 redirect to a specified redict_uri is a normal part of the OAuth 2 authentication flow.

1) you cant call an apps script with authentication. You need to publish it as anonymous access as a contentService.
2)you are also calling the wrong url. Call the service url not the redirected one that you get in the browser.

Simple Android authentication and requests after it

I'm implementing an android app and I'm having trouble understanding how I can implement a login feature (very simple, no encryption needed) and how it works after the user logs in
So, the first thing to do is make a Request, I send the login, and password,with an http POST method probably?
and the server replies with a token of some sort, correct?
Then I save that token, and what happens next? I have a bunch of pages I need to make GET requests on, but I also need to send the token someway, right?
How exactly can I make that?
thank you

You pretty much have it summed up I guess. Let the app send the credentials with a POST, the server checks if they are okay, then sends back a token (some random String maybe). When you make the GET requests after login, send the token with a custom HTTP header and let the server check it. The server has a list of valid tokens and checks if the received token is valid. If not, it responds with an error message, else it does what it's supposed to do.
That's all very basic and not at all secure of course.
Edit: The GET request could be done like this:
HttpClient client = new DefaultHttpClient();
HttpGet get = new HttpGet("someUrl.com/rest");
get.setHeader("Authorization", "someTokenYouCreated");
HttpResponse response = client.execute(get);
You'll find lot's of examples about calling a REST method. You'll have to look up how to handle that header on the server side, but that can't be too difficult either.