Hello,

I'm working on an OAuth client accessing protected resources on a RTC server. Everything works except oauth_callback, as described in RFC5849 (http://tools.ietf.org/html/rfc5849) page 5. I request the temporary credentials with a HTTP request like this (line breaks inserted to approve readability):

POST /jazz/oauth-request-token HTTP/1.1

Content-type: text/xml

accept: application/x-oslc-cm-change-request+xml

Authorization: OAuth oauth_consumer_key="3163bafc00b6464389c2c5cea775ahd5",

oauth_signature_method="HMAC-SHA1",

oauth_timestamp="1289556753",

oauth_nonce="240922495296885",

oauth_version="1.0",

oauth_callback="https%3A%2F%2Fclient.company.com%2Fready",

oauth_signature="1eP%2B9z5mVPCFSvvfcYDA7vVoDFM%3D"

User-Agent: JakartaCommons-HttpClient/3.1

Host: rtc.company.com:9443

Content-Length: 0

I then get the following response from RTC:

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Content-Type:application/x-www-form-urlencoded;charset=UTF-8

Content-Length: 118

Date: Fri, 12 Nov 2010 13:12:27 GMT



oauth_token=bbe3459c626644df84a2acc743d0c68f&oauth_token_secret=9%2BCxV%2B2%2F9ITYYpl3%2BjMUy3NWB9xJwGx6cL4B8fvaKso%3D

I would have expected a oauth_callback_confirmed=true in the response. Also, when authorizing the request, no redirect to the callback url occurs.

Question is, does the RTC OAuth server implement oauth_callback?

Bests Regards,
//OLof