Q:

Apache CXF OAuthDataProvider in a JAX-RS web application

I'm writing a plain JAX-RS web application that exposes a REST API; I use Spring, but only for actual configuration, and rely on plain CXF and Hibernate for all other functionality.
I now want to secure certain parts of the API with OAuth 1.0. To do this, I am trying to use org.apache.cxf.rs.security.oauth.provider.OAuthDataProvider (Along with some other beans) in conjunction with my database.
However, I find the documentation to be very unclear, and it's difficult to find examples showing how this bean is supposed to be used. Specifically, these things are unclear:

The createAccessToken and createRequestToken methods are supposed to create tokens. I do presumably also have to persist the generated tokens to the database. But how much of each token do I have to persist? Is it enough to store (consumerKey, tokenId, tokenSecret) or is it necessary to also persist e.g. the client secret, the callback URI, scopes, etc?
Similarly, in getAccessToken and getRequestToken, how much do I have to "fill in" for the service to work? Is it enough to provide the token ID and secret, or do I really have to provide a whole Client object as well, etc?
What exactly do I have to provide in finalizeAuthorization?
If I skip doing any of the above (e.g. by not setting the client secret in getAccessToken), do I lose some functionality?

I have a fairly solid understanding of the OAuth 1.0 protocol; the reason for most of the questions above is that it's difficult to discern what CXF keeps track of for me.

A:

I agree documentation is really poor about details in section Writing OAuthDataProvider of OAuth 1.0 JAX-RS documentation for CXF. I would say CXF does not keep track of anything, as this interface is supposed to provide token creation and persistence.
You are completely free how to do token creation and persistence, either with in memory storage or database persistence with direct JDBC or Hibernate.
I propose you get inspiration from the following examples:

Sample implementation (in memory) from CXF and maybe also its initial commit in sandbox.
globus-oauth-demo project

... and guess the remaining details in debug session.
Hope this helps

