Implement OAuth2 with resource owner password credentials on Android

Question

I need to make calls to services which are secured by OAuth2 resource owner password credentials. I tried all the libraries on oauth.net/code, but with no success. All of them seem not to provide this kind of authentication, but seem to be great with 3 legged authentication.

My user should login with username and password, but I do not want to store username and password. I want to get an access token and refresh this token from time to time.

My network communication is currently based on spring 4 android and the resttemplate you can find there.

Any suggestions, which library I could use? I think this is a common problem.

Answer 1

I couldn't find anything either, so I've put together a library myself, and I am releasing it to the public.

Usage:

import org.sdf.danielsz.OAuth2Client;
import org.sdf.danielsz.Token;

OAuth2Client client = new OAuth2Client(username, password, app-id, app-secret, site);
Token token = client.getAccessToken();

token.getResource(client, token, "/path/to/resource?name=value");

With this grant type, the client application doesn't need to store the username/password of the user. Those credentials are asked once and exchanged for an access token. This token can then be used to access protected resources.

To check if a token has expired:

token.isExpired();

To manually refresh a token:

Token newToken = token.refresh(client);

A more involved example can be found in the README on github.