[yutaka]

Here is the consumer web app's snippet I have used for testing;

At first, you get singpost jar file below and import some classes to your test web app.
oauth-signpost - Project Hosting on Google Code

import oauth.signpost.OAuth;
import oauth.signpost.OAuthConsumer;
import oauth.signpost.OAuthProvider;
import oauth.signpost.basic.DefaultOAuthProvider;
import oauth.signpost.http.HttpRequest;
import oauth.signpost.basic.HttpRequestAdapter;
import oauth.signpost.jetty.JettyOAuthConsumer;
import oauth.signpost.signature.OAuthMessageSigner;
import oauth.signpost.signature.SignatureMethod;

In your test servlet's doGet, you check if the request parameter includes "oauth_token" or not.

If it doesn't

OAuthConsumer consumer = new JettyOAuthConsumer(CONSUMER_KEY,
CONSUMER_SECRET, SignatureMethod.HMAC_SHA1);

OAuthProvider provider = new DefaultOAuthProvider(consumer,
BASE_ENDPOINT_URL+REQUEST_TOKEN_ENDPOINT_URL, BASE_ENDPOINT_URL+ACCESS_TOKEN_ENDPOINT_URL,
BASE_ENDPOINT_URL+AUTHORIZE_WEBSITE_URL);

String url = provider.retrieveRequestToken(CALLBACK_URL);
hs.setAttribute("provider", provider);
response.sendRedirect(url);

If it does

HttpSession hs = request.getSession(false);
OAuthProvider provider = (OAuthProvider)hs.getAttribute("provider");
String oaverifier = request.getParameter("oauth_verifier");
provider.retrieveAccessToken(oaverifier);

HttpURLConnection connection = (HttpURLConnection) new URL("http://<your zimbra server>/service/home/<user name>@<your domain name>/inbox.rss").openConnection();

connection.setRequestMethod("GET");

HttpRequest req = new HttpRequestAdapter(connection);
provider.getConsumer().sign(req);
connection.connect();

Note:
+This app is for Jetty.
+REQUEST_TOKEN_ENDPOINT_URL = "/req_token";
+ACCESS_TOKEN_ENDPOINT_URL = "/access_token";
+AUTHORIZE_WEBSITE_URL = "/authorization";

I hope it will help you.

And maybe I will include also a consumer app sample like above in next version of OAuth Provider Extension.