PHP - Oauth As An Authentication Method

OVERVIEW:

The code is about making call to the escreen web service using SOAP and Curl with client authentication required. Currently I am not getting any result only HTTP 403 and 500 errors.
The call requires client authenticate cert to be on the callng site.

CODE:

    $content = "<TicketRequest>
      <Version>1.0</Version>
      <Mode>Test</Mode>
      <CommitAction></CommitAction>
      <PartnerInfo>
      <UserName>xxxxxxxxxx</UserName>
      <Password>xxxxxxxxxxx</Password>
      </ PartnerInfo>
      <RequestorOrderID></RequestorOrderID>
      <CustomerIdentification>
        <IPAddress></IPAddress>
        <ClientAccount>xxxxxxxxxx</ClientAccount>
        <ClientSubAccount>xxxxxxxxxx</ClientSubAccount>
        <InternalAccount></InternalAccount>
        <ElectronicClientID></ElectronicClientID>
      </CustomerIdentification>
      <TicketAction>
        <Type></Type>
        <Params>
          <Param>
          <ID>4646</ID>
          <Value></Value>
          </Param>
        </Params>
      </TicketAction>
    </TicketRequest>";
    
    $wsdl  = "https://services.escreen.com/SingleSignOnStage/SingleSignOn.asmx";
    
    $headers = array(  "Content-type: text/xml;charset=\"utf-8\"", 
         "Accept: text/xml", 
         "Cache-Control: no-cache", 
         "Pragma: no-cache", 
      //   "SOAPAction: \"\"", 
         "Content-length: ".strlen($content),
        ); 
     
    
    $ch = curl_init(); 
    curl_setopt($ch, CURLOPT_URL, $wsdl); 
    curl_setopt($ch, CURLOPT_HEADER, 1); 
    curl_setopt($ch, CURLOPT_VERBOSE, '1');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
    curl_setopt($ch, CURLOPT_POSTFIELDS, $content); 
    
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, '1');
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, '1');
    //curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type: text/xml"));
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); 
    //curl_setopt($ch, CURLOPT_HTTPHEADER, array('SOAPAction: ""')); 
    curl_setopt($ch, CURLOPT_CAPATH, '/home/pps/');
    curl_setopt($ch, CURLOPT_CAINFO,  '/home/pps/authority.pem');
    curl_setopt($ch, CURLOPT_SSLCERT, 'PROTPLUSSOL_SSO.pem');
    curl_setopt($ch, CURLOPT_SSLCERTPASSWD, 'xxxxxxxxxxxx');
    
    $output = curl_exec($ch);
    
    // Check if any error occured
    if(curl_errno($ch))
    {
        echo 'Error no : '.curl_errno($ch).' Curl error: ' . curl_error($ch);
    }
    
    print_r($output);



QUESTIONS:

1. I need to call the RequestTicket method and pass the XML string to it.
   I don't know how to do it here(pass the method name to call).

2. For client authentication they gave us three certs, one root cert, one intermediate
   cert and a client authentication cert PROTPLUSSOL_SSOpem(it was a .pfx file). Since we are on linux we converted them to pem . In curl calls I could not find way to how to include both the root cert and the intermediate cert ,so I combined them by making a new pem file and copying the intermediate cert and them the root cert and naming it authority.pem .
I am not sure whether it works or not and would like your opinion.

3. For the current code Iam getting the error
   Error no : 77 Curl error: error setting certificate verify locations: CAfile: /home/pps/authority.pem CApath: /home/pps/

 
  If I disable the curl error message,I am getting blank page with page title 403 - Forbidden. Access is denied.

  If I comment out the CURLOPT_CAPATH and CURLOPT_CAINFO lines it gives http 500 error page with the message as content and the following at the top.

 > HTTP/1.1 500 Internal Server Error. Cache-Control: private Content-Type: text/html Server: Microsoft-IIS/7.5 X-AspNet-Version: 1.1.4322 X-Powered-By: ASP.NET Date: Thu, 02 Sep 2010 14:46:38 GMT Content-Length: 1208

If I comment out as above and also CURLOPT_SSLCERT and CURLOPT_SSLCERTPASSWD it gives 403 error with the message as content.

So I would request you to help me out by pointing out whats wrong with the current code.

Thank you.

Is anyone able to get this https://github.com/csrui/oauth2-php oAuth PDO example to work?

I cannot see where to enter the DB details.

Thanks in advance.

Good day Campers!   Having spent the better part of my day trawling the internet for an answer I have gotten nowhere so have come to you lovely people for help.   I found a nice little tutorial on PHP gang that would allow me to update my twitter feed from my website using PHP and OAuth. I set up my twitter app with no issues and generated the API keys. Set the App to 'read/write' permissions and then regenerated the keys The app is marked to "Allow this application to be used to Sign in with Twitter"   The issue is that when I click the little button to sign in to twitter, the page redirects but displays the generic "Cannot connect to Twitter" error message that has been defined in the code. I do not get asked to "Allow" the script to connect to twitter like it seems to do in the demo.   The PHPGang solution has 4 bits of script so I'm wondering if it has something to do with this as I understand the Abrahams script has slightly more so I do wonder if something is missing. I'm not sure. One of the main problems I am facing is that I have never actually done this before so I don't know where I have gone wrong or what I am even looking for help wise......   I have the following scripts: callback.php

<?php
/**
 * Take the user when they return from Twitter. Get access tokens.
 * Verify credentials and redirect to based on response from Twitter.
 */
session_start();
require_once('oauth/twitteroauth.php');
require_once('config.php');

if (isset($_REQUEST['oauth_token']) && $_SESSION['oauth_token'] !== $_REQUEST['oauth_token']) {
  $_SESSION['oauth_status'] = 'oldtoken';
  header('Location: ./destroysessions.php');
}

$connection = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET, $_SESSION['oauth_token'], $_SESSION['oauth_token_secret']);

$access_token = $connection->getAccessToken($_REQUEST['oauth_verifier']);
//save new access tocken array in session
$_SESSION['access_token'] = $access_token;

unset($_SESSION['oauth_token']);
unset($_SESSION['oauth_token_secret']);

if (200 == $connection->http_code) {
  $_SESSION['status'] = 'verified';
  header('Location: ./index.php');
} else {
  header('Location: ./destroysessions.php');
}
?>

config.php

<?php
/**
 * @file
 * A single location to store configuration.
 */
define('CONSUMER_KEY', 'MY CONSUMER KEY');
define('CONSUMER_SECRET', 'MY SECRECT CONSUMER KEY');
define('OAUTH_CALLBACK', 'URL OF WHERE I AM REDIRECTING TO');
?>

destroysessions.php

<?php
/**
 * @file
 * Clears PHP sessions and redirects to the connect page.
 */

/* Load and clear sessions */
session_start();
session_destroy();

/* Redirect to page with the connect to Twitter option. */
header('Location: ../index.php');
?>

index.php

	<?php
	require_once('oauth/twitteroauth.php');
	require_once('config.php');
		if(isset($_POST["status"]))
			{
				$status = $_POST["status"];
				if(strlen($status)>=130)
				{
					$status = substr($status,0,130);
				}
				$access_token = $_SESSION['access_token'];
				$connection = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET, $access_token['oauth_token'], $access_token['oauth_token_secret']);

				$connection->post('statuses/update', array('status' => "$status"));
				$message = "Tweeted Sucessfully!!";
			}
		if(isset($_GET["redirect"]))
			{
				$connection = new TwitterOAuth(CONSUMER_KEY, CONSUMER_SECRET);

				$request_token = $connection->getRequestToken(OAUTH_CALLBACK);

				$_SESSION['oauth_token'] = $token = $request_token['oauth_token'];
				$_SESSION['oauth_token_secret'] = $request_token['oauth_token_secret'];

				switch ($connection->http_code) {
					case 200:
						$url = $connection->getAuthorizeURL($token);
						header('Location: ' . $url);
						break;
					default:
						echo '<div class="par">Could not connect to Twitter. Refresh the page or try again later.</div>';
				}
		exit;
			}
		if (empty($_SESSION['access_token']) || empty($_SESSION['access_token']['oauth_token']) || empty($_SESSION['access_token']['oauth_token_secret'])) {

				echo '<a href="./index.php?redirect=true"><img src="./images/lighter.png" alt="Sign in with Twitter"/></a>';
			}
		else
			{
				echo "<a href='destroysessions.php'>Logout</a><br>";
				echo '<div class="par">'.$message.'<div>
				<form action="index.php" method="post">
				    <input type="text" name="status" id="status" placeholder="Write a comment....">
				    <input type="submit" value="Post On My Wall!" style="padding: 5px;">
				</form>';
			}
	?>

Now, I am unsure if there is anything wrong with the API keys I have generated or if there is something missing. Is there anyone who can point me in the right direction or offer some advice on where to turn?   Thanks!
Edited by lauren_etherington, 04 September 2014 - 10:36 AM.

Hello guys, I am trying my best to upload images to Twitpic by using PHP and OAuth (PECL extension) and I keep getting "Could not authenticate you (header rejected by twitter)".

Can someone tell me what am I doing wrong?

This is my code so far:

$arguments[] = "oauth_consumer_key=" . $this->consumer_key;
$arguments[] = "oauth_nonce="        . md5(time());
$arguments[] = "oauth_signature_method=HMAC-SHA1";
$arguments[] = "oauth_timestamp="    . time();
$arguments[] = "oauth_token="        . $this->oauth_token;
$arguments[] = "oauth_version=1.0";

$sbs       = oauth_get_sbs("POST", "http://api.twitpic.com/2/upload.xml", $arguments);
$signature = urlencode(base64_encode(hash_hmac("sha1", $sbs, $this->consumer_secret . "&", true)));

$arguments[] = "oauth_signature="    . $signature;

sort($arguments);

$headers[] = "X-Auth-Service-Provider: http://api.twitter.com/1/account/verify_credentials.json";
$headers[] = "X-Verify-Credentials-Authorization: OAuth\n" . implode(",\n", $arguments);

$postfields["key"]     = $this->api_key;
$postfields["media"]   = "@$image";
$postfields["message"] = $message;

$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, "http://api.twitpic.com/2/upload.xml");
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, $postfields);
curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
curl_setopt($curl, CURLOPT_VERBOSE, true);
curl_setopt($curl, CURLOPT_HEADER, true);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
echo curl_exec($curl);

Kind regards and thanks in advance.

Hi,

I'm trying to integrate my web based application with facebook.

First of all, I created page login/facebook which redirects user to the URL: Code: [Select]
https://www.facebook.com/dialog/oauth?client_id=MY_ID&redirect_uri=https://www.domain.com/connect/facebook&scope=email,user_about_me,user_location
So far so good. Have no problems at this stage.

If user authorize my application, he gets redirected to the www.domain.com/connect/facebook page. On this page I create user in my database using data returned by FB or just authorize user and create session. On this step I have issues. When I use code from the examples from Facebook Developers Help Page everything works:

Code: [Select]
$token_url = "https://graph.facebook.com/oauth/access_token?client_id="
    . $this->app_id . "&redirect_uri=" . urlencode($my_url) . "&client_secret="
    . $this->secret . "&code=" . $code;
$access_token = file_get_contents($token_url);
$graph_url = "https://graph.facebook.com/me?" . $access_token;
$user_object = json_decode(file_get_contents($graph_url));

When I use following snippet everything works perfectly. However I prefer to use PHP-SDK and having problems. When I use following snippet:
Code: [Select]
$session = $this->facebook->getSession();
var_dump($session);
            if( $session )
            {
                try
                {
                    $uid = $this->facebook->getUser();
                    $me = $this->facebook->api('/me');

                    var_dump('me');
                }
                catch (FacebookApiException $e)
                {
                    error_log($e);
                }
            }session is null.

After having some fun with PHP-SDK I noticed some funny stuff: When I use SDK getLoginUrl() method to generate redirect URL, it seems to be partially working.
Code: [Select]
$login_url = $this->facebook->getLoginUrl(
        array(
            'api_key' => $this->api_key,
            'req_perms' => 'email,user_work_history,user_about_me,user_location',
            'next' => 'https://www.domain.com/connect/facebook'
        )
    );
Now when users authorizes my app, he's being redirected to correct page with some params, URL looks like:
Code: [Select]
https://www.domain.com/connect/facebook?session={"session_key"%3A"11111111111-111111111"%2C"uid"%3A"11111111"%2C"expires"%3A0%2C"secret"%3A"111111111"%2C"base_domain"%3A"domain.com"%2C"access_token"%3A"1111111|222222.0-33333|sdvsdvsdvsdvsdv"%2C"sig"%3A"gsdbsdbsdbsdbsdbsdbsdb"}
Anyone has any idea why it's not hashes or it shouldn't? Or should I leave php-sdk and use the way with file_get_contents()?