ansaurus

Question

oauth_verifier is not passed using DotNetOpenAuth's Webconsumer

Answer 1

+1 A:

If you look at the log, you'll see that DotNetOpenAuth received the verifier message and recognized it as a 1.0a message where the log says "received UserAuthorizationResponse (1.0.1)" (since 1.0.1 is DNOA's way of saying 1.0a).

You'll also note from the log that DNOA sends a "AuthorizedTokenRequest (1.0)" message. This strongly suggests that the ServiceProviderDescription object that you've passed to the WebConsumer instance with a ProtocolVersion property set to V10 instead of V10a.

You may be initializing the ServiceProviderDescription correctly when you first send the user to the Service Provider, but initializing it without setting its version number the second time when you call WebConsumer.ProcessAuthorization.

Another possibility is that the Service Provider is violating the OAuth 1.0a spec, and DotNetOpenAuth detects this and overrides your setting and decides to treat the service provider as merely an OAuth 1.0 service provider. If this is what's happening, you see your own ServiceProviderDescription object's ProtocolVersion property change from 1.0.1 to 1.0, and your log will include this substring "Expected OAuth service provider at endpoint"...

Andrew Arnott 2010-01-17 01:27:27

so this message >>Expected OAuth service provider at endpoint DotNetOpenAuth.Messaging.MessageReceivingEndpoint to use OAuth 1.0.1 but 1.0 was detected. Adjusting service description to new version.<<is telling me that the SP is violating the 1.0a spec? Can I live with that, and still pass the verifier back to the AccessTokenEndpoint?

BozoJoe 2010-01-17 02:35:02

thanks Andrew, the SP is replying to the request token without a oauth_callback_confirmed specified. Looks like that pushed the version back to 1.0. I forced the version back up to 1.0a before doing ProcessUserAuthorization(), and that change is sending the verifier in the body.

BozoJoe 2010-01-19 06:24:54

Cool. I'm glad you've found a workaround. I hope you'll also email the SP guys and tell them they've got a bug.

Andrew Arnott 2010-01-19 20:34:19

Answer 2

A:

Hi Arnott,

I have been trying to make work the OAuthServiceProvider sample given by DotNetOpenAuth. But I get the error "A token in the message was not recognized by the service provider".

Consumer Side:-

var response = consumer.PrepareRequestUserAuthorization(callback.Uri, requestParams, null);

//its Ok till here. I get the token

consumer.Channel.Send(response);

when consumer sends this respone I get error on provider side while reading request

Provider Side:-

public void ProcessRequest(HttpContext context) { Line 20: IProtocolMessage request = sp.ReadRequest();

It throws the error "A token in the message was not recognized by the service provider"

This shows that version is set to 1.0A

WebConsumer consumer = new WebConsumer(
        new ServiceProviderDescription {
            RequestTokenEndpoint = oauthEndpoint,
            ProtocolVersion = ProtocolVersion.V10a,
            UserAuthorizationEndpoint = oauthEndpoint,
            AccessTokenEndpoint = oauthEndpoint,
            TamperProtectionElements = new DotNetOpenAuth.Messaging.ITamperProtectionChannelBindingElement[] {
                new HmacSha1SigningBindingElement(),
            },
        },
        tokenManager);

Could you please tell me where I am making mistake??

Thanks in advance.

Amit

Amit 2010-04-15 11:11:22

Please post a question, instead of posting an anwer ;)

vdboor 2010-08-20 11:54:37

ansaurus

tags:

views:

answers:

oauth_verifier is not passed using DotNetOpenAuth's Webconsumer

related questions