SoftwareEngineering

dalicore-ejb

DaliCore is based on the Java EE 6 API's

dalicore-oauth

leverage authentication provided by Social Networks

dalicore-externalnetwork

token identifies a User, App or Page session and provides information about granted permissions

Types

User Access

generated in the login flow when a

Facebook Pages

use this token to perform API calls

Page Access

used to

user who is the

App Secret or an App Access token should never be included in any code that could be accessed by anyone other than a developer of the app

must grant an extended permission called

use this type of token to make API calls

unique to each page, admin and app

App Access

useful to modify app settings, create and manage test users or read App Insights data

use app tokens to publish or delete content

unique to each app

Security Best Practices

extremely important that an App Secret is not compromised

App Access Tokens should only be used directly from your app's servers in order to provide the best security

refreshes and extends each time the user triggers the login flow

Extending

user access tokens

response from this endpoint will include the

exchange this token for a longer-lived one

passing it to the /oauth endpoint from your server

grant_type parameter of fb_exchange_token

/oauth/access_token

grant_type=fb_exchange_token

fb_exchange_token=SHORT_LIVED_ACCESS_TOKEN

by default you'll receive a short-lived token that is only valid for 1-2 hours

error_reason=user_denied

Handling Revoked Permissions to see how best to proceed

Step 6. Exchange the code for an Access Token

exchange it for a User access token that can then be used to make API requests

/oauth/access_token

server-side request to the following OAuth endpoint:

client_secret

code=CODE_GENERATED_BY_FACEBOOK

body of the response

access_token

persist this User access token in your database or in a session variable

must have the same base domain as that specified in the App Domain property of your app's settings

URL of the form https://apps.facebook.com/YOUR_APP_NAMESPACE

scope=user_birthday,read_stream

Step 4. Add Permissions to Login Dialog request

comma-separated list of any of the Permissions available

Step 5. Handle the response from the Login Dialog

Step 5. Handle the response from the Login Dialog

Step 5. Handle the response from the Login Dialog

Step 5. Handle the response from the Login Dialog

YOUR_REDIRECT_URI

Step 3. Redirect the user to the Login Dialog

Login for Server-side Apps

Login for Server-side Apps

Login for Server-side Apps

Login for Server-side Apps

Login for Server-side Apps

Login for Server-side Apps

way to authenticate users in situations where the use of client-side Javascript is not appropriate.

Login for Server-side Apps

received an access token for them and can make API calls on their behalf

Step 5. Handle the response from the Login Dialog

include CSRF protection using the state parameter

if the user has authorized the app, they will be redirected to:

YOUR_REDIRECT_URI

code=CODE_GENERATED_BY_FACEBOOK

redirect_uri as the same URL that redirect the user to the Login Dialog

SN independent services like

OAuth connectors

generic Authentication and user profile

portable between Java EE 6

independent of CDI implementation

build on top of scribe-java

accomplish the same idea using generics

superclass requests information about the child, and the child provides it

(CHILD)

<CHILD extends BakedGood<CHILD>>

CHILD

(CHILD)

CHILD

abstract

extends BakedGood<Cake>

The type parameter is saying “the Child class must extend Base<Child>”, forcing the Child class to provide its own type to the type system

Now that we can return the derived class in our chained method calls we are free to alternately call methods from the base class and the derived class

All of the normal polymorphic abilities are retained (you can see that we’ve implemented the abstract bake() method required by BakedGood)

.bake()

.bake()

practical applications of fluent API’s can be found

best article I was able to find on the topic was

Flapi is an API generator for Java, which generates chained API's for improved fluency in your code

code generation utility for creating fluent API in Java

stable release

builds what is called a descriptor

blocks

methods

Blocks can be reused by using their name later in a addBlockReference(...) method

block contains methods

block can in turn nest other blocks

last()

Invocation Tracking

allowed invocations:

any()

exactly(int x)

atLeast(int x)

atMost(int x)

uses to build the Java code model and generate the classes and interfaces of a builder

between(int x, int y)

last(Class c)

Creating a Descriptor

Flapi.builder()

setPackage(String)

setStartingMethodName(String)

setDescriptorName(String)

setReturnType(Class)

enableCondensedClassNames()

addMethod(...)

startBlock(...)

addBlockChain(...)

addBlockReference(...)

Implementing the Helpers

Flapi creates only the interfaces for the helpers

necessary because otherwise it would not be possible to add methods to a call chain which are defined in the concrete assertion class, but not in the more generic superclass where isNotNull is implemented

<ELEMENT_TYPE>

ELEMENT_TYPE actual

ELEMENT_TYPE actual

GenericAssert<ELEMENT_TYPE>

SELF_TYPE

SELF_TYPE

SELF_TYPE self()

(SELF_TYPE) this

SELF_TYPE isNotNull()

 return self();

SELF_TYPE extends GenericAssert<SELF_TYPE, ELEMENT_TYPE>

only subclasses of GenericAssert are allowed as SELF_TYPE

sometimes called a

assumes that you will be adding Spring Social to a

2. Configure Spring Social

3. Create Views

4. Invoke APIs