title: Android Dev - Callback URL not working... (0_o)
body: <p>I'm working on an android application for my research, and I am working with OAuth (signpost library) to gain access to user data from a web service which is also a part of the development process. I am able to flow through the common steps of OAuth, and I use a Uri (for callback to the app), and can get to the step where I invoke the devices browser, choose to verify my app, and the next step is SUPPOSED to redirect the browser BACK to the application....</p>
  
  <p>Instead I get an error that reads something like "you do not have permission to open: </p>
  
  <blockquote>
    <p>appSchema://appName?authorizationSensitiveInfo..."
    the appendages after the '?' are the
    oauth_token and oauth_verifier from
    the service (we can assume all steps
    up until the redirection are
    "correct").</p>
  </blockquote>
  
  <p>Possible problems lie within the <code>appSchema://appName</code> part. from my understanding this is the redirect URL which tells the Uri to use the phone's browser to locate my application and invoke the onResume() method. Where do the values for <code>appSchema://appName</code> come from (defined in manifest? if so where?). </p>
  
  <p>Why the problem with permission? Must I set permissions for my Uri to access my app? I'm lost...if you need code snippets to help me please reply, I didn't include any code because this is more like a concept I just missed...I'm not at my machine now but I can supply code if that would make things easier to understand. Really beating my head in here...</p>
  
  <p><strong>IN RESPONE TO A GREAT ANSWER HERE IS HOW I HANDLE MY ON RESUME</strong></p>
  
  <pre><code>protected void onResume() {
      super.onResume();       
      Uri uri = this.getIntent().getData();
      if (uri != null &amp;&amp; uri.toString().startsWith(CALLBACK_URL)) {
          Log.d("StepGreenM", uri.toString());
          String verifier = uri.getQueryParameter(OAuth.OAUTH_VERIFIER);
          Log.d("StepGreenM", verifier);
          try {
  
              provider.retrieveAccessToken(consumer, verifier);
              TOKEN = consumer.getToken();
              REQUEST_SECRET = consumer.getTokenSecret();
  
              Log.d("StepGreenM", TOKEN);
              Log.d("StepGreenM", REQUEST_SECRET);
  
          } catch (OAuthMessageSignerException e) {
              e.printStackTrace();
          } catch (OAuthNotAuthorizedException e) {
              e.printStackTrace();
          } catch (OAuthExpectationFailedException e) {
              e.printStackTrace();
          } catch (OAuthCommunicationException e) {
              e.printStackTrace();
          }
      }
  
      uri = getIntent().getData();
      if (uri != null &amp;&amp; CALLBACK_URI.getScheme().equals(uri.getScheme())) {
          String token = settings.getString(HomeScreen.REQUEST_TOKEN, null);
          String secret = settings.getString(HomeScreen.REQUEST_SECRET, null);
          Intent i = new Intent(Intent.ACTION_VIEW); // Intent to go to the action view
  
          try {
              if(!(token == null || secret == null)) {
                  consumer.setTokenWithSecret(token, secret);
              }
              String otoken = uri.getQueryParameter(OAuth.OAUTH_TOKEN);
              String verifier = uri.getQueryParameter(OAuth.OAUTH_VERIFIER);
  
              // We send out and save the request token, but the secret is not the same as the verifier
              // Apparently, the verifier is decoded to get the secret, which is then compared - crafty
              // This is a sanity check which should never fail - hence the assertion
              Assert.assertEquals(otoken, consumer.getToken());
  
              // This is the moment of truth - we could throw here
              provider.retrieveAccessToken(consumer, verifier);
              // Now we can retrieve the goodies
              token = consumer.getToken();
              secret = consumer.getTokenSecret();
              //Save it to a settings file
              HomeScreen.saveAuthInformation(settings, token, secret);
              // Clear the request stuff, now that we have the real thing
              HomeScreen.saveRequestInformation(settings, null, null);
              i.putExtra(USER_TOKEN, token);
              i.putExtra(CONSUMER_SECRET, secret);
  
              //GO TO APPLICATION
  
          } catch (OAuthMessageSignerException e) {
              e.printStackTrace();
          } catch (OAuthNotAuthorizedException e) {
              e.printStackTrace();
          } catch (OAuthExpectationFailedException e) {
              e.printStackTrace();
          } catch (OAuthCommunicationException e) {
              e.printStackTrace();
          } finally {
              startActivity(i); // we either authenticated and have the extras or not, but are going to the action view
              this.setContentView(R.layout.indivaction);
              finish();
          }
      }
  }
  </code></pre>
  
  <p>Not sure what really makes this fall apart...but like I said it force closes when this method is invoked. I know it makes it past the redirect because I use an httpSniffer to check the messages to and from the server...</p>