The command button and its associated backing bean below initiates our request for an access_token.


<pre class="brush: xml">

 &lt;h:commandButton 
 actionListener="#{firingBean.codeRequest}"
 value "My Fb groups ..." /&gt;

</pre>



Step 1. Request for Facebook authorization code.



<pre class="brush: java">
 public class FiringBean {

 public void codeRequest (ActionEvent event) {

 String furl = "https://www.facebook.com/dialog/oauth?
 + "client_id=YOUR_APP_ID&"
 + "redirect_uri=http://YOUR_REDIRECT_URL.xhtml&" 
 + "scope=publish_stream,user_groups,status_update&"
 + "response_type=code";

 HttpServletResponse response = 
 (HttpServletResponse) context.getExternalContext().
 getResponse();

 try {
 response.sendRedirect(furl); 
 } catch (Exception e) {
 
 }
 }

</pre>





The scope is a comma separated list of permissions we are requesting from Facebook. You can find the complete 

list of permissions <a href="http://developers.facebook.com/docs/reference/api/permissions/" target="_blank" 

class="news_link">here</a>.




If not already logged-in the user will be presented with the Facebook login dialog. 
The request for permission dialog will also be presented to the user on successful login. It will be an error
if the user denied permission to your App. If granted permission your App gets a code.


Step 2 Exchange your code for access_token. The code below is the backing bean of our redirect URL from 

Step 1.



<pre class="brush: java">

 class RedirectURLBackingBean {

 private String access_token;

 @PostConstruct
 public void init() {

 HttpServletRequest req = (HttpServletRequest)
 FacesContext.getCurrentInstance().
 getExternalContext().getRequest();
 String error = req.getParameter("error_reason");
 if (error != null) {
 try {
 // you may want to pass this error to
 // the error redirect url
 String error_desc = 
 req.getParameter("error_description");
 ((HttpServletResponse) FacesContext.
 getCurrentInstance().
 getExternalContext().
 getResponse()).
 sendRedirect("http://ERROR_URI.xhtml");
 } catch (Exception e) {
 }
 }

 String code = req.getParameter("code");
 if (code != null) {
 int ret = retrieveToken(code);
 // process return value
 } else {
 // Redirect or tell the user about the error
 }
 }

 private int retrieveToken(String code) {

 HttpClient client = new DefaultHttpClient();
 HttpPost post = 
 new HttpPost(
 "https://graph.facebook.com/oauth/access_token");

 try {

 String[][] parameters = {
 {"client_id", "YOUR_APP_ID"},
 {"client_secret", "YOUR_APP_PASSWORD"},
 {"redirect_uri", 
 "http://USUALLY_THE_SAME_PAGE.xhtml"},
 {"code", code}
 };


 List&lt;NameValuePair> nameValuePairs = 
 new ArrayList&lt;NameValuePair>(1);

 for (int i = 0; i < parameters.length; i++) {
 nameValuePairs.add
 (new BasicNameValuePair(parameters[i][0], 
 parameters[i][1]));
 }

 post.setEntity(
 new UrlEncodedFormEntity(nameValuePairs));

 HttpResponse resp = client.execute(post);
 BufferedReader rd = 
 new BufferedReader(new InputStreamReader(
 resp.getEntity().getContent()));

 String message = "";
 String lineData;
 while ((lineData = rd.readLine()) != null) {
 message += lineData;
 }

 String token = null;

 // Add more safety traps
 String[] params = message.split("&");
 if (params != null) {
 for (int i = 0; i < params.length; i++) {
 if (params[i].contains("access_token")) {
 String[] B = params[i].split("=");
 if (B != null) {
 token = B[1];
 }
 break;
 }
 }
 } else {
 // Let the user know about the error.
 return 0;
 }

 access_token = token;

 return 1;

 } catch (Exception e) {
 return 0;
 }

 }

 public String getAccessToken () {
 return access_token;
 }
 }


</pre>



Now you have an access_token. 



Our backing bean above use Apache http components library, it is <a href="http://hc.apache.org/" target="_blank" class="news_link">available here</a>. If you are using Netbeans press ctrl-alt-i to include the required imports.




Good luck.

Implementing Facebook server flow authentication in Java/JSF