cool-auth

Cool Auth system was first introduced with the OAuth module in Drupal. It provides a security layer over Drupal and OAuth system in Drupal. It lets user/developers to register their applications with their user accounts on drupal based websites and produce application_key + application_secret pair corresponding to it.

Specifications of COOL-AUTH system

1. Provides a system for users/developers so that they can register their websites/applications over your website to use OAuth system on your website and can produce a pair of application_key + application+secret corresponding to it.
2. Use a combination of application_key and application_sig(explain-later) to authenticate application who is requesting OAuth access to website on behalf of some user's account.
3. Administrator uses these cool-auth registered applications to keep track of data flow from their websites via oauth.

How this system works with OAuth

COOL-AUTH system over OAuth module makes it very powerful API system to share site's resources across web on behalf of user's account.

In first step of oauth call (i.e. request token call) two additional parameters are needed to be passed to authenticate registered application via cool-auth syestem.First additional parameter is "application_key" which is cool-auth registered application key. Second parameter is "application_sig" - which is md5 hash of your application_secret(cool auth appl. secret) and "nonce"(which is a randomly generated string passed in oauth request).

• Parameters to include in first call (request token call - when using cool auth)
  • application_key: This is cool-auth application key which is passed as parameters for authentication of registered application
  • application_sig: This is signature which is md5 hash of oauth_nonce and application_secret(cool-auth app. secret)
    $application_secret = md5($application_secret.$oauth_nonce);
    Please use modified OAuth library as present in the OAuth module to use this feature - these two features are included by library support only.
• So our Request token call will look like now as
  

  http://example.com/oauth/request/
  <tr/> oauth_version=1.0&
  <tr/>oauth_nonce=c4b5a80b7b76af05dea89ed2ca784759&
  <tr/>oauth_timestamp=1219658025&
  <tr/>oauth_consumer_key=oauth_key&
  <tr/>oauth_signature_method=HMAC-SHA1&
  <tr/>oauth_signature=R1VAArqmn1G1aPkI8OWpGuhMIgg%3D
  <tr/>application_key=cool_auth_app_key&
  <tr/>application_sig=application_sig (which is here md5($application_key.$oauthnonce))