PHP Oauth Invalid signature issue - php

Question

I am trying to start with OAuth 1.0 in PHP and I faced weird problem. I created pseudo-Consumer which generates signature according to specification and sends it with used parameters via POST to Provider. Consumer uses:
$oauth_consumer_key = '123';
$oauth_consumer_secret = '456';
$oauth_signature_method = 'HMAC-SHA1';
$oauth_timestamp = time();
$oauth_nonce = uniqid();
$oauth_version = '1.0';
$oauth_callback = 'http://localhost/oauth/callback';
$oauth = new OAuth($oauth_consumer_key, $oauth_consumer_secret);
$oauth->enableDebug();
$oauth_signature = $oauth->generateSignature('POST', $oauth_callback, array($oauth_consumer_key, $oauth_signature_method, $oauth_timestamp, $oauth_nonce, $oauth_version));
On Providers side everything seems to work as intended. All values are received:
object(OAuthProvider)[1]
public 'consumer_key' => string '123' (length=3)
public 'consumer_secret' => string '456' (length=3)
public 'nonce' => string '5390610001c90' (length=13)
public 'token' => null
public 'token_secret' => null
public 'timestamp' => string '1401970944' (length=10)
public 'version' => string '1.0' (length=3)
public 'signature_method' => string 'HMAC-SHA1' (length=9)
public 'callback' => string 'http://localhost/oauth/callback' (length=31)
public 'request_token_endpoint' => boolean true
public 'signature' => string '8lNbnGTOen4TEOHS9KcpgCiBl+M=' (length=28)
But this is the end of honeymoon - attempt to verify signature causes error: signature_invalid. This is what I used on Providers side:
$provider = new OAuthProvider();
$provider->isRequestTokenEndpoint(true);
$provider->consumerHandler('lookupConsumer');
$provider->timestampNonceHandler('timestampNonceChecker');
try
{
$request_verified = $provider->checkOAuthRequest();
}
catch(OAuthException $e)
{
echo $provider->reportProblem($e);
}
and what I receive as an problem report:
oauth_problem=signature_invalid&debug_sbs=POST&http%3A%2F%2Flocalhost%2Foauth%2Fcustom_auth%2Frequest_token.php&oauth_callback%3Dhttp%253A%252F%252Flocalhost%252Foauth%252Fcallback%26oauth_consumer_key%3D123%26oauth_nonce%3D5390610001c90%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1401970944%26oauth_version%3D1.0
As an addition what baffles me is that when I use generateSignature for the same constant parameters (for debugging I set timestamp and nonce to constant values) it gives me every time different value like if there still was some random element I am not aware of. As a validation sample - hash_hmac does not have such issue.
Am I missing something or is there a problem with official PHP OAuth implementation (http://pecl.php.net/package/oauth)?

Answer 1

I have been scratching my head with this exact question for almost a week now because of lack of documentation but this is what solved everything for me.
It seems the OAuth class does its own request signing. I had done the exact same steps as you to no avail but once I removed all the parameters and just called fetch/getRequestToken on my url it all worked.
My code that works
$consumer_key = 'key';
$consumer_secret = 'secret';
$request_token_url = 'http://someurl.com/oauth/request-token';
$oauth = new OAuth($consumer_key, $consumer_secret);
$oauth->enableDebug(); //helpful debug
try {
$oauth->getRequestToken($request_token_url);
} catch (OAuthException $e) {
echo OAuthProvider::reportProblem($e); //easier to debug oauth exceptions
}
//this should hold the `request_token` and `request_token_secret` parameters for you to call getAccessToken
$response = json_decode($oauth->getLastResponse());
I have my own provider set up at http://someurl.com/oauth/request-token that looks like:
$provider = new OAuthProvider();
$provider->consumerHandler(array($this,'consumerHandler'));
$provider->timestampNonceHandler(array($this,'timestampNonceHandler'));
$provider->tokenHandler(array($this,'tokenHandler'));
$provider->setRequestTokenPath('/oauth/request-token');
try {
$request_verified = $provider->checkOAuthRequest();
} catch(OAuthException $e) {
echo $provider->reportProblem($e);
}
//provider now holds all the required timestamp, nonce, and signature
I hope this helps, even though it's a year after