developing and testing hybrid google openid + oauth with openid4java on localhost

Question

I am trying to implement hybrid Google OpenID + OAuth protocol in order to identify my users and to access their Google calendar data.

Sample request looks like:

https://www.google.com/accounts/o8/id
?openid.ns=http://specs.openid.net/auth/2.0
&openid.claimed_id=http://specs.openid.net/auth/2.0/identifier_select
&openid.identity=http://specs.openid.net/auth/2.0/identifier_select
&openid.return_to=http://www.example.com/checkauth
&openid.realm=http://www.example.com
&openid.assoc_handle=ABSmpf6DNMw
&openid.mode=checkid_setup
&openid.ns.oauth=http://specs.openid.net/extensions/oauth/1.0
&openid.oauth.consumer=www.example.com
&openid.oauth.scope=http://docs.google.com/feeds/+http://spreadsheets.google.com/feeds/

I am using openid4java. I tried to follow this post: library-to-integrate-googles-oauth-openid-hybrid-in-java-web-app

But I came into trouble when testing my application on localhost.

As you can see in aforementioned sample request, there are three attributes that must be equal:

openid.realm
openid.oauth.consumer
openid.return_to

I have registered some domain with google and obtained consumer key and secret. But when I want to develop and debug my application on localhost (i. e. openid.return_to=http://localhost:8080/ and openid.realm=http://*.mydomain.com and openid.oauth.consumer=www.mydomain.com) and supply my key and secret, openid4java RealmVerifier rejects such authentication request.

I have even tried to supply completely valid options (my registered domain instead of localhost) - it seemed to function, but the redirection went away (I don't want to/can't deploy the application in that domain because of missing technologies.).

Could you please advise, how to develop such application on localhost? Is there any trick how to test such application?

Thanks for any help!

Answer 1

Try adding your your-machine.your-domain.com which points to 127.0.0.1 in the /etc/hosts (on linux) on your dev box and then hit your application as http://your-machine.your-domain.com

(note: replace your-machine with your machine name and your-domain with the domain you have registered with Google)