Testing a two legged OAuth

This page describes how to use a two legged OAuth with Services 3.x and OAuth 7.x.

Why would you want to do this?

• You may want a mobile application access to resources, but not require a login from the user

• At the time of this posting there is no beta release for OAuth 7.x. I am currently using a version from Git.
• This is a very basic tutorial - it does not currently cover authorization levels / specific permissions.

Create a context

• Create a context at http://yoursite/admin/config/services/oauth/contexts
• Ensure that HMAC-SHA1 is a selected Signature method
  

  Create a user

• Create a dummy Drupal user at admin/people/create (This is so you can create a consumer. There may be a better way to do this without the need to create a new Drupal user)
• Create a consumer for your user, at user/<uid>/oauth/consumer/add. I used the same name as my context name, I'm not sure it matters in this instance.
• Grab the key and secret for your newly created consumer

Alot of this code is taken and modified from the oauth.test unit tests found inside the OAuth.module itself.
Note that the call in accessTokenRequest returns nothing if the token validation was successful. If there was a problem, the header would return a 401 (access denied).

NOTE

: You will need to replace the $url_prefix to match your website.

<?php
$url_prefix = 'http://127.0.0.1/yoursite/';


function print_nice($print) {
  print("<pre>");
  print_r($print);
  print("</pre>");
}

function requestTokenRequest($consumer, $method = 'HMAC-SHA1') {
  //$url = $this->getAbsoluteUrl('oauth/request_token');
  global $url_prefix;
  $url = $url_prefix . 'oauth/request_token';
  
  if (substr($method, 0, 4) == 'HMAC') {
    $signature_method = new OAuthSignatureMethod_HMAC(strtolower(substr($method, 5)));
  }

  $request = DrupalOAuthRequest::from_consumer_and_token($consumer, NULL, 'POST', $url, NULL);
  $request->sign_request($signature_method, $consumer, NULL);

  $fields['signature'] = $request->get_parameter('oauth_signature');
  $data = $request->to_postdata();

  print_nice($request->get_parameters());
  
  $options = array(
    CURLOPT_POST => TRUE, 
    CURLOPT_RETURNTRANSFER => TRUE,
    CURLOPT_URL => $url,
    CURLOPT_POSTFIELDS => $data,
    // CURLOPT_HEADER => true,
    CURLOPT_VERBOSE => true,
  );

  $ch = curl_init();
	curl_setopt_array($ch, $options);
  $result = curl_exec($ch);
  
  echo 'curlinfo request_token:::';
  print (curl_getinfo($ch, CURLINFO_HTTP_CODE));

  return $result;
}
  
  
function accessTokenRequest($consumer, $tokens, $type = 'access') {
  //$url = $this->getAbsoluteUrl('oauth/access_token');
  $method = 'HMAC-SHA1';
  $url = '';
  global $url_prefix;
  
  if ($type == 'verify') {
    $url = $url_prefix . 'oauth/test/valid-access-token';
  }
  else {
    $url = $url_prefix . 'oauth/access_token';
  }
  
  if (substr($method, 0, 4) == 'HMAC') {
    $signature_method = new OAuthSignatureMethod_HMAC(strtolower(substr($method, 5)));
  }

  $token = new DrupalOAuthToken($tokens['oauth_token'], $tokens['oauth_token_secret'], $consumer);

  $request = DrupalOAuthRequest::from_consumer_and_token($consumer, $token, 'POST', $url, NULL);
  $request->sign_request($signature_method, $consumer, $token);

  $fields['signature'] = $request->get_parameter('oauth_signature');
  $data = $request->to_postdata();
  print_nice($request->get_parameters());
  
  $options = array(
    CURLOPT_POST => TRUE, 
    CURLOPT_RETURNTRANSFER => TRUE,
    CURLOPT_URL => $url,
    CURLOPT_POSTFIELDS => $data,
    // CURLOPT_HEADER => true,
    CURLOPT_VERBOSE => true,
  );

  $ch = curl_init();
	curl_setopt_array($ch, $options);
  $result = curl_exec($ch);
  
  echo 'curlinfo access_token:::';
  echo curl_getinfo($ch, CURLINFO_HTTP_CODE);

  return $result;
}
  
  
  
  
  
$_SERVER['HTTP_HOST'] = 'localhost';
$_SERVER['REMOTE_ADDR'] = '127.0.0.1';
define('DRUPAL_ROOT', dirname(realpath(__FILE__)));
include_once 'includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);

// MATCH YOUR CONSUMER KEY/SECRET
$consumer = new DrupalOAuthConsumer('sws4hKQZSfCuP3ShfymCkWMH2FmCsWTW', '4BQyhys5UakETENY5k6vUg3n7MtRqoe9', array());

$result = requestTokenRequest($consumer);
print_nice($result);

$split = explode('&', $result);
foreach ($split as $line) {
  $token_split = explode('=', $line);
  $tokens[$token_split[0]] = $token_split[1];
}
print_nice('```` requested tokens ````');
print_nice($tokens);

$result = accessTokenRequest($consumer, $tokens, 'verify');
$results = explode('&', $result);
foreach ($results as $line) {
  $split = explode('=', $line);
  $access_token[$split[0]] = $split[1];
}
print_nice('```` token result ````');
print_nice($result);


// NOW, ANY SUBSEQUENT REQUESTS CAN USE THESE TOKENS (the ```` requested tokens `````)