title: Apache CXF OAuthDataProvider in a JAX-RS web application
body: <p>I'm writing a plain JAX-RS web application that exposes a REST API; I use Spring, but only for actual configuration, and rely on plain CXF and Hibernate for all other functionality.</p>
  
  <p>I now want to secure certain parts of the API with OAuth 1.0. To do this, I am trying to use <a href="http://cxf.apache.org/javadoc/latest/org/apache/cxf/rs/security/oauth/provider/OAuthDataProvider.html" rel="nofollow"><code>org.apache.cxf.rs.security.oauth.provider.OAuthDataProvider</code></a> (Along with some other beans) in conjunction with my database.</p>
  
  <p>However, I find the documentation to be very unclear, and it's difficult to find examples showing how this bean is supposed to be used. Specifically, these things are unclear:</p>
  
  <ul>
  <li>The <code>createAccessToken</code> and <code>createRequestToken</code> methods are supposed to create tokens. I do presumably also have to persist the generated tokens to the database. But how much of each token do I have to persist? Is it enough to store <code>(consumerKey, tokenId, tokenSecret)</code> or is it necessary to also persist e.g. the client secret, the callback URI, scopes, etc?</li>
  <li>Similarly, in <code>getAccessToken</code> and <code>getRequestToken</code>, how much do I have to "fill in" for the service to work? Is it enough to provide the token ID and secret, or do I really have to provide a whole <code>Client</code> object as well, etc?</li>
  <li>What exactly do I have to provide in <code>finalizeAuthorization</code>?</li>
  <li>If I skip doing any of the above (e.g. by not setting the client secret in <code>getAccessToken</code>), do I lose some functionality?</li>
  </ul>
  
  <p>I have a fairly solid understanding of the OAuth 1.0 protocol; the reason for most of the questions above is that it's difficult to discern what CXF keeps track of for me.</p>