Scribe and Atlassian rest - scribe

Question

I'm trying to use Scribe to use Atlassian Jira using example from here:
https://developer.atlassian.com/display/JIRADEV/JIRA+REST+API+Example+-+OAuth+authentication
Anyone have any luck?
Here's what I got:
public class JiraAPI extends DefaultApi10a {
static final String BASE = "http://xasdf:8080/plugins/servlet";
#Override
public String getAccessTokenEndpoint()
{
return BASE + "/oauth/access-token";
}
#Override
public String getAuthorizationUrl(Token requestToken)
{
return BASE + "/oauth/authorize?oauth_token="+requestToken.getToken();
}
#Override
public String getRequestTokenEndpoint()
{
return BASE + "/oauth/request-token";
}
#Override
public SignatureService getSignatureService() {
return new RSASha1SignatureService(getPrivateKey());
}
private static PrivateKey getPrivateKey()
{
String str = "MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAMPQ5BCMxlUq2TYy\n"+
"iRIoEUsz6HGTJhHuasS2nx1Se4Co3lxwxyubVdFj8AuhHNJSmJvjlpbTsGOjLZpr\n"+
"HyDEDdJmf1Fensh1MhUnBZ4a7uLrZrKzFHHJdamX9pxapB89vLeHlCot9hVXdrZH\n"+
"nNtg6FdmRKH/8gbs8iDyIayFvzYDAgMBAAECgYA+c9MpTBy9cQsR9BAvkEPjvkx2\n"+
"XL4ZnfbDgpNA4Nuu7yzsQrPjPomiXMNkkiAFHH67yVxwAlgRjyuuQlgNNTpKvyQt\n"+
"XcHxffnU0820VmE23M+L7jg2TlB3+rUnEDmDvCoyjlwGDR6lNb7t7Fgg2iR+iaov\n"+
"0iVzz+l9w0slRlyGsQJBAPWXW2m3NmFgqfDxtw8fsKC2y8o17/cnPjozRGtWb8LQ\n"+
"g3VCb8kbOFHOYNGazq3M7+wD1qILF2h/HecgK9eQrZ0CQQDMHXoJMfKKbrFrTKgE\n"+
"zyggO1gtuT5OXYeFewMEb5AbDI2FfSc2YP7SHij8iQ2HdukBrbTmi6qxh3HmIR58\n"+
"I/AfAkEA0Y9vr0tombsUB8cZv0v5OYoBZvCTbMANtzfb4AOHpiKqqbohDOevLQ7/\n"+
"SpvgVCmVaDz2PptcRAyEBZ5MCssneQJAB2pmvaDH7Ambfod5bztLfOhLCtY5EkXJ\n"+
"n6rZcDbRaHorRhdG7m3VtDKOUKZ2DF7glkQGV33phKukErVPUzlHBwJAScD9TqaG\n"+
"wJ3juUsVtujV23SnH43iMggXT7m82STpPGam1hPfmqu2Z0niePFo927ogQ7H1EMJ\n"+
"UHgqXmuvk2X/Ww==";
try
{
KeyFactory fac = KeyFactory.getInstance("RSA");
PKCS8EncodedKeySpec privKeySpec = new PKCS8EncodedKeySpec(Base64.decodeBase64(str.getBytes()));
return fac.generatePrivate(privKeySpec);
}
catch (Exception e)
{
throw new RuntimeException(e);
}
}
}
Scribe has always been easy with other OAuth based providers, but this provider always "oauth_problem=signature_invalid" from debug:
generating signature...
base string is: POST&http%3A%2F%2Fxasdf%3A8080%2Fplugins%2Fservlet%2Foauth%2Frequest-token&oauth_callback%3Doob%26oauth_consumer_key%3Dhardcoded-consumer%26oauth_nonce%3D1556398454%26oauth_signature_method%3DRSA-SHA1%26oauth_timestamp%3D1357151719%26oauth_version%3D1.0
signature is: AJugUeZGup5dZvjNjx6bec6OrAszZVK+pMrTzahZbbzKzGkbli7okBy2KO5ww+OtqqnHWRgyzfWnQ0k6R5U0JzjR4QiOANJuwV8Un1NTZsrK32daefCp2uZ6W2d2Y/fmIl3toyCjAx41c3oJ78572vVFmBGihHUTUOYTlFP1X3M=
appended additional OAuth parameters: { oauth_callback -> oob , oauth_signature -> AJugUeZGup5dZvjNjx6bec6OrAszZVK+pMrTzahZbbzKzGkbli7okBy2KO5ww+OtqqnHWRgyzfWnQ0k6R5U0JzjR4QiOANJuwV8Un1NTZsrK32daefCp2uZ6W2d2Y/fmIl3toyCjAx41c3oJ78572vVFmBGihHUTUOYTlFP1X3M= , oauth_version -> 1.0 , oauth_nonce -> 1556398454 , oauth_signature_method -> RSA-SHA1 , oauth_consumer_key -> hardcoded-consumer , oauth_timestamp -> 1357151719 }
using Http Header signature
sending request...
response status code: 401
Exception in thread "main" org.scribe.exceptions.OAuthException: Response body is incorrect. Can't extract token and secret from this: 'oauth_signature=AJugUeZGup5dZvjNjx6bec6OrAszZVK%2BpMrTzahZbbzKzGkbli7okBy2KO5ww%2BOtqqnHWRgyzfWnQ0k6R5U0JzjR4QiOANJuwV8Un1NTZsrK32daefCp2uZ6W2d2Y%2FfmIl3toyCjAx41c3oJ78572vVFmBGihHUTUOYTlFP1X3M%3D&oauth_signature_base_string=POST%26http%253A%252F%252Ftracker%253A8080%252Fplugins%252Fservlet%252Foauth%252Frequest-token%26oauth_callback%253Doob%2526oauth_consumer_key%253Dhardcoded-consumer%2526oauth_nonce%253D1556398454%2526oauth_signature_method%253DRSA-SHA1%2526oauth_timestamp%253D1357151719%2526oauth_version%253D1.0&oauth_problem=signature_invalid&oauth_signature_method=RSA-SHA1'
response body: oauth_signature=AJugUeZGup5dZvjNjx6bec6OrAszZVK%2BpMrTzahZbbzKzGkbli7okBy2KO5ww%2BOtqqnHWRgyzfWnQ0k6R5U0JzjR4QiOANJuwV8Un1NTZsrK32daefCp2uZ6W2d2Y%2FfmIl3toyCjAx41c3oJ78572vVFmBGihHUTUOYTlFP1X3M%3D&oauth_signature_base_string=POST%26http%253A%252F%252Ftracker%253A8080%252Fplugins%252Fservlet%252Foauth%252Frequest-token%26oauth_callback%253Doob%2526oauth_consumer_key%253Dhardcoded-consumer%2526oauth_nonce%253D1556398454%2526oauth_signature_method%253DRSA-SHA1%2526oauth_timestamp%253D1357151719%2526oauth_version%253D1.0&oauth_problem=signature_invalid&oauth_signature_method=RSA-SHA1
at org.scribe.extractors.TokenExtractorImpl.extract(TokenExtractorImpl.java:41)

Answer 1

As far as I can tell, you cannot use Scribe with JIRA/Atlassian OAuth, since Scribe does not support RSA-SHA1 signatures, but this is the only Signature available in Atlassian's OAuth providers.
The only Java library, that I could find, which supports this method is the one used in the example code linked in the questions - the net.oauth one.

Answer 2

I have this working using scribe 1.3.6 using the provided RSASha1SignatureService, here's how I'm extracting the private key (from a PKCS#8 PEM file, the one with the BEGIN PRIVATE KEY header, not the BEGIN RSA PRIVATE KEY, which is the SSLeay format)
package com.company.client.api;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Base64;
import org.scribe.builder.api.DefaultApi10a;
import org.scribe.builder.api.DefaultApi20;
import org.scribe.model.OAuthConfig;
import org.scribe.model.Token;
import org.scribe.services.RSASha1SignatureService;
import org.scribe.services.SignatureService;
public class JiraApi extends DefaultApi10a {
private static final String AUTHORIZE_URL = "http://localhost:8080/plugins/servlet/oauth/authorize?oauth_token=%s";
private static final String REQUEST_TOKEN_RESOURCE = "http://localhost:8080/plugins/servlet/oauth/request-token";
private static final String ACCESS_TOKEN_RESOURCE = "http://localhost:8080/plugins/servlet/oauth/access-token";
#Override
public String getAccessTokenEndpoint() {
return ACCESS_TOKEN_RESOURCE;
}
#Override
public String getRequestTokenEndpoint() {
return REQUEST_TOKEN_RESOURCE;
}
#Override
public String getAuthorizationUrl(Token requestToken) {
return String.format(AUTHORIZE_URL, requestToken.getToken());
}
#Override
public SignatureService getSignatureService() {
return new RSASha1SignatureService(getPrivateKey());
}
private PrivateKey getPrivateKey() {
try {
byte[] key = Base64.getDecoder().decode(JiraClientImpl.privateKey); // this is the PEM encoded PKCS#8 private key
PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(key);
KeyFactory kf = KeyFactory.getInstance("RSA");
return kf.generatePrivate(keySpec);
} catch (Exception e) {
throw new RuntimeException(e);
}
}
}