OAuth2 account creation via meetup.com API [#1901450]

Hi, I am trying to allow users to create new accounts using their MeetUp.com credentials. As Frans points out in this thread: http://drupal.org/user/514222 aligning what OAuth Connector is asking for with what the API is naming it can be very difficult. I'm looking for some concordance between OAuth Connector and MeetUp.com. A "secret decoder ring" if you will. I hope if I post the data I have and what I'm guessing at, someone will be able to set me right. And then I can either document it or maybe add a Provider Preset.

MeetUp allows you to generate OAuth consumers at: http://www.meetup.com/meetup_api/. They prompt you for 4 things and I added what I think each should be.

Consumer name
Any Name like "MyMeeting"

Application Website
According to their docs, not the root of the Drupal site, but a page ON the Drupal site that explains why you want to connect.

De-authorization URL
A URL on the Drupal site saying you will not be able to log in with your MeetUp username anymore

Redirect URI
I have no idea. They say "This will enable your application to use OAuth 2 authorization". I saw a suggestion that it may be site.com/oauth/authorized/1

On the OAuth Connector side, the first three are pretty self-explanatory. One creates a name and then gets the OAuth Consumer Key and Secret from http://www.meetup.com/meetup_api/oauth_consumers/

Under OAuth Consumer Advanced Settings I can check OAuth v.2. They say they provide implementations of both the server and implicit protocol flows. And provide the following endpoints for both where necessary.

Authorization https://secure.meetup.com/oauth2/authorize
Access Tokens https://secure.meetup.com/oauth2/access

So I put
Authorization endpoint to be https://secure.meetup.com/oauth2/authorize
and Access token endpoint to be https://secure.meetup.com/oauth2/access

I leave scope blank because although they document "Permission Scopes" I don't really know what should be in that box literally. Plus it sounds as if "API keys are implicitly provided the basic scope."

I leave some of the other options alone. I use HMAC-SHA1 for Signature method and JSON for the Mapping. It seems MeetUp can support both JSON and XML.

Finally I am asked for a URL of the API resource representing the authorized user. I don't know what that means. Somehow I decided it should be:site.com/oauthlogin/api/user/info (That does return the UID). But I don't know if that is right and if it is, I need to set the pull-down to "does not match."

So if I take my best guess at all of this I get:

Invalid Authorization request
If you were directed here by another application, contact its developer

And trust me, since I am the developer, he's not going to be much help.

Sorry this post was so verbose. But if someone can help me figure out what I'm missing I promise to develop equally verbose documentation and/or a screencast explaining how this works.

Comments

Comment #1

Frans CreditAttribution: Frans commented 29 January 2013 at 00:37

Invalid Authorization request
If you were directed here by another application, contact its developer

You get that on a url where you can start debugging.

Look at the parameters in the url.
https://secure.meetup.com/oauth2/authorize
?client_id=YOUR_CONSUMER_KEY
&response_type=code
&redirect_uri=YOUR_CONSUMER_REDIRECT_URI

One of the parameters (key or redirect uri) is not correct.

I guess that is redirect, since you didnot give that to meetup.com in the when signing up for an app?

Comment #2

mcfilms CreditAttribution: mcfilms commented 29 January 2013 at 01:34

Whoops

Comment #3

mcfilms CreditAttribution: mcfilms commented 29 January 2013 at 01:33

I suspect that is my issue as well. But I really don't know what the URI redirect is supposed to be. I think this is a url on my site. What should my YOUR_CONSUMER_REDIRECT_URI be?

They say "This will enable your application to use OAuth 2 authorization". I saw a suggestion that it may be drupal-site.com/oauth/authorized/1 I also tried it with drupal-site.com/oauthlogin/api/user/info

This is the URL I get:

https://secure.meetup.com/oauth2/authorize?redirect_uri=http%3A%2F%2FSIT...

In the above, I changed the domain to SITE.com and the id and token to hash marks to post here.

I see two issues: I have nothing in "scope=" and that may be a problem. Also it appears the OAuth connector is delivering the data is not in the order the MeetUp api wants. It is sending redirect_url first. Is this my primary issue? Are there overrides (within the UI) for me to construct a URL in the format MeetUp wants?

Comment #4

Topcheese CreditAttribution: Topcheese commented 29 January 2013 at 04:49

The redirct URL should point to the Callback URL with your domain. You will get the URL once you setup the preset. I didn't use scope.
I believe I was also using this base URL https://api.meetup.com. The documentation was sort of confusing, but then I had decided to switch to Oauth2, and I can't remember if I was having problems with the secure.meetup.com URL. Sorry I'm not much help right now, but I will work with it tonight or Tomorrow as I believe it is a nice addition and I want to do my part.

Comment #5

Frans CreditAttribution: Frans commented 29 January 2013 at 11:26

I have had a glance at the meetup.com API. The Method for getting your own identity (needed for oauthconnector config to fetch the user_id and name) is
http://www.meetup.com/meetup_api/docs/2/members/

See last sentence:
https://api.meetup.com/members?member_id=self&key=ABDE12345AB2324445

Comment #6

Topcheese CreditAttribution: Topcheese commented 29 January 2013 at 18:50

Thanks Fran! In trying to figure it all out I ended up trying the URL's https://api.meetup.com/2/member/self and https://api.meetup.com/2/member/:id.

I figured I was doing something wrong. I'm looking at it again.

Comment #7

Topcheese CreditAttribution: Topcheese commented 30 January 2013 at 10:00

Well, just as I thought. I'm back to where I was and I'm redirected back to the site and it shows

Home » Authorization finished » Authorization finished
Authorization finished
The application has been authorized

'
I also see the available scope options, but I keep getting a bad request with the endpoint URL, I'll have to keep playing with it.

Comment #8

mcfilms CreditAttribution: mcfilms commented 30 January 2013 at 17:04

Topcheese, it sounds like you are further along than I am. May I ask what you put in for "URL of the API resource representing the authorized user." I don't know what that means. Somehow I decided it should be:site.com/oauthlogin/api/user/info (That does return the UID). But I am still getting "Invalid Authorization request".

Nevermind! I caught up. For the viewers at home, I used the "CALLBACK URL" found at: admin/structure/oauthconnector

The connection now bounces back but I get"error=invalid_scope".

Comment #9

mcfilms CreditAttribution: mcfilms commented 30 January 2013 at 17:09

Follow up:

Interesting. Looks like you need to leave the SCOPE field blank. I now get prompted to log into my Meet-Up account. Doing so I get redirected back to my site with a "The application has been authorized" message.

YAY! But now, how will I go about converting this "Authorized User" into an actual account?

Comment #10

Topcheese CreditAttribution: Topcheese commented 30 January 2013 at 20:12

@mcfilms, well let me catch up with you then. I do believe you need the scope. I was going to be adventurous and use the basic and message scope.

Edit: I created a member_id field, but I believe the field order has to be correct.

Comment #11

mcfilms CreditAttribution: mcfilms commented 30 January 2013 at 21:00

@Topcheese - once I cleared the scope field, then my request went through (but did it bring any data back, I don't know.)

I've also been bugging a developer with MeetUp. Let me share some of the insights I got:

__________________

... I tried MeetUp API and doesn't focus on creating users.I spoke to Wizone, the developer, and he suggested using the OAuth Connector module (add associated dependent modules). But I am dismayed to find that it does not seem you output the data in the order MeetUp expects. It creates a url like this: https://secure.meetup.com/oauth2/authorize?redirect_uri=http%3A%2F%2FSIT...

Should MeetUp be able to parse a url such as this? The docs say it should be consumer key, then the response_type=code, and then ending with the redirect URI. So I am currently delivering the parameters out of order and I get an "Invalid Authorization Request" error.

It looks like you are using the server flow, so you want to redirect your user to a url like http://www.meetup.com/meetup_api/auth/#oauth2server-auth. Note that the redirect_uri provided must at least start with the one you've registered with you oauth client. The order of parameters does not matter.

Meetup will redirect you back to the url identified by the redirect_uri parameter, after which you need to make a second request to exchange the code you received for an access token described here http://www.meetup.com/meetup_api/auth/#oauth2server-access This is similar to oauth1's exchange of request tokens for access tokens.

Once you have an access token you're good to go.

In regards to the answer to my second question, I don't think my role on meetup matters as long as I am a member of the group, correct? (Asked: "If I am not the primary organizer of the group, can I still create an app under my user and retrieve the login credentials on the Drupal site? Or do I need to be an organizer of the meetings?")

The owner of the oauth consumer does not determine the what the authorized user can see. The oauth consumer will only ever be able to see what the authorized user can.

I am creating a site, there is a button for visitors to "Log In With Meet Up". If they push this button they (theoretically, when it works) get prompted to allow this app to see their email and avatar. Once they okay this the site should (again, theoretically) be able to log them in, create an account with their email and avatar. In the future, if they are not logged in, they can once again log in with MeetUp.

This sounds correct although we do not provide direct access to our member's email without their consent.

This is my dream, but is it possible?

Yes.

__________________

So it does look like this is possible and it does look like the order in the query do not matter.

Comment #12

Topcheese CreditAttribution: Topcheese commented 31 January 2013 at 00:18

@mcfilms, I see that you are correct in that meetup provides the basic scope implicitly. I'm still wondering about the order, I know that is has got to be easy to figure out, but I'm just not looking at it right, because what seems to make sense to me is not working.

Comment #13

Frans CreditAttribution: Frans commented 1 February 2013 at 16:52

The order is the order in the uri right? The order in the uri cannot be the problem.

I think everything goes right now. But the userID cannot be found. Use the right endpoint in userID and find out via the api docs from meetup.com what it returns. Choose the settings according the api docs.

Comment #14

mcfilms CreditAttribution: mcfilms commented 1 February 2013 at 18:04

Topcheese and Frans,

Like I said, I am able to get the back and forth working with Drupal (even with the url in the scrambled order). What I have not been able to do is retrieve any information or actually create an account. On the MeetUp API Google group I was told:

Meetup isn't going to create user accounts in your Drupal instal. You will need to either write a module or find one that does that automatically after logging in via oauth.

Not sure if there is already a module that does that.

I have not been able to find one that does that either. I know what we are looking for is possible. I see it with FB and Twitter logins in this Commerce Kickstart video on this page:
http://www.drupalcommerce.org/blog/4571/kickstart-tip-1-social-logins-ma...

Comment #15

Topcheese CreditAttribution: Topcheese commented 1 February 2013 at 18:55

@Franz, you are correct and that is where I was stuck at. Thank you for your input. I had read something on Oauth2 and decided to put that idea on hold for a minute.

Meetup.com has a really nice API that they provide, and there should be a preset for OAuth Connector.

@mcfilms, once you find the correct field to get from Meetup. I was fixed on what to send and not the return, so all I got was either a bad request, or just authorized finished with no errors in the log.