Authenticate User for Embedding using Tokens

using System;
using System.Linq;
using System.Web;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

namespace CsWebSite
{
	public partial class Default : System.Web.UI.Page
	{
		public const String API_PATH = "http://mySite.com/API3/";
		protected void Page_Load(object sender, EventArgs e)
		{
			
			//logging the user for embed
			String adminTokenEmbed = getToken("authenticateUserEmbed", new
			{ 	
				userName = "adminUser1",
				password = "abc123!",
				domain = "myEmbedSite.com"
			});

			//alternative embed using the admim user token (so not requiring the user's password)
			String userTokenEmbed = getToken("authenticateUserEmbedByToken", new
			{ 	
				userIdentity = "userName",
				token = adminTokenEmbed
			});			//this cookie should be applied at myEmbedSite.com, assuming myEmbedSite.com is installed on a different domain
			Response.Cookies.Add(new HttpCookie("PyramidEmbeddedAuth", userTokenEmbed));
		}

	//generic method for getting the token via REST
		private String getToken(String service, Object data)
		{
			HttpClient client = new HttpClient();

			StringContent content = null;
			content = new StringContent(JsonConvert.SerializeObject(data), Encoding.UTF8, "application/json");
			Task<HttpResponseMessage> response = client.PostAsync(API_PATH + "authentication/" + service, content);

			return response.Result.Content.ReadAsStringAsync().Result;
		}
		
		//generic method for running REST methods
		private JToken callApi(String service, Object data, String token)
		{
			HttpClient client = new HttpClient();
			client.DefaultRequestHeaders.Add("paToken", token);
			StringContent content = null;
			content = new StringContent(JsonConvert.SerializeObject(data), Encoding.UTF8, "application/json");
			Task>HttpResponseMessage< response = client.PostAsync(API_PATH + service, content);

			String resultStr = response.Result.Content.ReadAsStringAsync().Result;
			if (resultStr.Count() == 0)
			{
				return null;
			}
			return JsonConvert.DeserializeObject>JObject<(resultStr)["data"];
		}
	}
}

		

import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpHandler;
import com.sun.net.httpserver.HttpServer;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.client.BasicResponseHandler;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.json.simple.JSONObject;

import java.io.IOException;
import java.net.InetSocketAddress;

public class Main {
	private static final String pyramidPath = "http://mySite.com/API3/";

	public static void main(String[] args) throws IOException {
		HttpServer server = HttpServer.create(new InetSocketAddress(8000), 0);
		server.createContext("/embed", new EmbedHandler());

		server.setExecutor(null); // creates a default executor
		server.start();

	}


	private static class EmbedHandler implements HttpHandler {
		@Override
		public void handle(HttpExchange httpExchange) throws IOException {
			//logging the user
			JSONObject adminCredentials = new JSONObject();
			adminCredentials.put("userName", "adminUser1");
			adminCredentials.put("password", "abc123!");
			adminCredentials.put("domain", "myEmbedSite.com");
			String adminToken = getToken("authenticateUserEmbed", adminCredentials);

			//getting user's embed token using the admin's authenctication token
			JSONObject userCredentials = new JSONObject();
			adminCredentials.put("userIdentity", "JohnSmith");
			adminCredentials.put("token", adminToken);
			String userToken = getToken("authenticateUserEmbedByToken", userCredentials);


			//setting the cookie PyramidEmbeddedAuth to userToken
			byte[] message = "you logged in".getBytes();
			httpExchange.getResponseHeaders().add("Set-Cookie", "PyramidEmbeddedAuth=" + userToken);
			httpExchange.sendResponseHeaders(200, -1);
			httpExchange.getResponseBody().write(message);
			httpExchange.close();
		}
	}

	protected static String getToken(String service, JSONObject data) throws IOException {
		return sendPost("authentication/" + service, data.toJSONString());
	}


	protected static String sendPost(String path, String data) throws IOException {
		try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {

			String address = pyramidPath + path;
			HttpPost request = new HttpPost(address);
			StringEntity params = new StringEntity(data);
			request.addHeader("content-type", "application/x-www-form-urlencoded");
			request.setEntity(params);
			CloseableHttpResponse response = httpClient.execute(request);
			return new BasicResponseHandler().handleResponse(response);
		}
	}
}