oauth issue 68: Move jsontoken package to http project and update to latest OpenID Connect spec

oauth issue 68: Move jsontoken package to http project
http://code.google.com/p/google-oauth-java-client/issues/detail?id=68

Update to http://openid.net/specs/openid-connect-basic-1_0-23.html#id_token

depends on:
https://codereview.appspot.com/7330045/

[peleyal, 2013-02-14 23:53:24]

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
File
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java
(right):

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java:27:
* href="http://openid.net/specs/openid-connect-basic-1_0-23.html#id_token">ID
Token</a>.
Notice: the spec has reference to the following version of Json Web Token -
http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06, (from December
27, 2012),
while in your implementation of JSonWebToken, you have a reference to - 
http://tools.ietf.org/html/draft-jones-json-web-token-07, (from December 13,
2011).

They look similar, but maybe you want to check your implementation against the
newer version. 
I found a new header - "cty" (Content Type) on the version from 2012. Let's talk
about it tomorrow

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java:36:
public class IdToken extends JsonWebSignature {
Are there any tests to the new class?
Is there a sample that we should create \ update?

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
File
google-oauth-client/src/main/java/com/google/api/client/auth/security/PrivateKeys.java
(right):

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
google-oauth-client/src/main/java/com/google/api/client/auth/security/PrivateKeys.java:139:
*             {@link PemReader#readFirstSectionAndClose(java.io.Reader, String)}
instead.
Although it's just a link, please add a comment on this codereview that it's
based on https://codereview.appspot.com/7330045 (Issue 7330045: http: add
PemReader)

[yanivi, 2013-02-15 17:44:30]

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
File
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java
(right):

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java:27:
* href="http://openid.net/specs/openid-connect-basic-1_0-23.html#id_token">ID
Token</a>.
On 2013/02/14 23:53:24, peleyal wrote:
> Notice: the spec has reference to the following version of Json Web Token -
> http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06, (from December
> 27, 2012),
> while in your implementation of JSonWebToken, you have a reference to - 
> http://tools.ietf.org/html/draft-jones-json-web-token-07, (from December 13,
> 2011).
> 
> They look similar, but maybe you want to check your implementation against the
> newer version. 
> I found a new header - "cty" (Content Type) on the version from 2012. Let's
talk
> about it tomorrow

Done.

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java:36:
public class IdToken extends JsonWebSignature {
On 2013/02/14 23:53:24, peleyal wrote:
> Are there any tests to the new class?
> Is there a sample that we should create \ update?

In theory we should, but it is a hassle to write these.  For now, I've just
tested it manually.

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
File
google-oauth-client/src/main/java/com/google/api/client/auth/security/PrivateKeys.java
(right):

https://codereview.appspot.com/7304095/diff/8001/google-oauth-client/src/main...
google-oauth-client/src/main/java/com/google/api/client/auth/security/PrivateKeys.java:139:
*             {@link PemReader#readFirstSectionAndClose(java.io.Reader, String)}
instead.
On 2013/02/14 23:53:24, peleyal wrote:
> Although it's just a link, please add a comment on this codereview that it's
> based on https://codereview.appspot.com/7330045 (Issue 7330045: http: add
> PemReader)

Done.

[peleyal, 2013-02-15 19:20:27]

LGTM

[yanivi, 2013-02-15 22:45:36]

Variety of changes made.  Please take a look again.

[peleyal, 2013-02-19 14:45:07]

LGTM

https://codereview.appspot.com/7304095/diff/24002/google-oauth-client/src/mai...
File
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java
(right):

https://codereview.appspot.com/7304095/diff/24002/google-oauth-client/src/mai...
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java:152:
private Object authorizedParty;
why not string?

https://codereview.appspot.com/7304095/diff/24002/google-oauth-client/src/tes...
File
google-oauth-client/src/test/java/com/google/api/client/auth/openidconnect/IdTokenTest.java
(right):

https://codereview.appspot.com/7304095/diff/24002/google-oauth-client/src/tes...
google-oauth-client/src/test/java/com/google/api/client/auth/openidconnect/IdTokenTest.java:54:

Please add test for "public final boolean verifyTime(long currentTimeMillis,
long acceptableTimeSkewSeconds)" as well

[yanivi, 2013-02-19 14:59:53]

https://codereview.appspot.com/7304095/diff/24002/google-oauth-client/src/mai...
File
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java
(right):

https://codereview.appspot.com/7304095/diff/24002/google-oauth-client/src/mai...
google-oauth-client/src/main/java/com/google/api/client/auth/openidconnect/IdToken.java:152:
private Object authorizedParty;
On 2013/02/19 14:45:07, peleyal wrote:
> why not string?

The specification does not specify the format at all.  Very strange.  I have
been told by the Googlers that implemented the spec that it can either be a JSON
string or JSON array of strings, in which case Object is most appropriate.

https://codereview.appspot.com/7304095/diff/24002/google-oauth-client/src/tes...
File
google-oauth-client/src/test/java/com/google/api/client/auth/openidconnect/IdTokenTest.java
(right):

https://codereview.appspot.com/7304095/diff/24002/google-oauth-client/src/tes...
google-oauth-client/src/test/java/com/google/api/client/auth/openidconnect/IdTokenTest.java:54:

On 2013/02/19 14:45:07, peleyal wrote:
> Please add test for "public final boolean verifyTime(long currentTimeMillis,
> long acceptableTimeSkewSeconds)" as well

Done.