Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Additional parameters when obtaining request token

See original GitHub issue

Please let me know if I am reading the spec wrong. Under section 6.1.1 of the OAuth 1.0a spec, it mentions that it is possible to provide additional parameters when obtaining a request token:

6.1.1. Consumer Obtains a Request Token

To obtain a Request Token, the Consumer sends an HTTP request to the Service Provider’s Request Token URL. The Service Provider documentation specifies the HTTP method for this request, and HTTP POST is RECOMMENDED. The request MUST be signed and contains the following parameters:

oauth_consumer_key: The Consumer Key. oauth_signature_method: The signature method the Consumer used to sign the request. oauth_signature: The signature as defined in Signing Requests. oauth_timestamp: As defined in Nonce and Timestamp. oauth_nonce: As defined in Nonce and Timestamp. oauth_version: OPTIONAL. If present, value MUST be 1.0 . Service Providers MUST assume the protocol version to be 1.0 if this parameter is not present. Service Providers’ response to non-1.0 value is left undefined. oauth_callback: An absolute URL to which the Service Provider will redirect the User back when the Obtaining User Authorization step is completed. If the Consumer is unable to receive callbacks or a callback URL has been established via other means, the parameter value MUST be set to oob (case sensitive), to indicate an out-of-band configuration. Additional parameters: Any additional parameters, as defined by the Service Provider.

However, I notice that the getRequestToken() does not provide a way to specify additional parameters. It isn’t possible to override as it is final, and I am unable to override prepareRequestTokenRequest (as I could in 3.x) in order to supply these parameters, since it not only creates the request within that method, but signs it there as well using the private appendSignature method.

Issue Analytics

State:
Created 6 years ago
Reactions:1
Comments:9 (9 by maintainers)

Top GitHub Comments

1reaction

kullfarcommented, Mar 29, 2017

It’s better to use this final official RFC https://tools.ietf.org/html/rfc5849 interested section is https://tools.ietf.org/html/rfc5849#section-2.1

as for your question… I see… So making methods addOAuthParams and appendSignature protected will solve your issue?

0reactions

kullfarcommented, Apr 18, 2017

Pull Request https://github.com/scribejava/scribejava/pull/755 merged, releasing to the central today

Top Results From Across the Web

Adding an additional request parameter during Get OAuth token

Some of the auth endpoints require another parameter to be added beyond what Service Now is already adding from the OAuth entity profile....

How to pass additional parameters to OAuth2 client ...

1.- Set parameters as attachments (client_id, client_secret, grant_type, resource). ... 3.- HTTP Request calling the API using the token from previous step.

Additional parameters to get Access token [#3256272] - Drupal

I need to send 'resource' parameter to get Access token. The request will be sent to https://login.microsoftonline.com//oauth2/token with below ...

Authorization Code Request - OAuth 2.0 Simplified

The access token request will contain the following parameters. ... One way to authenticate the client is to accept another parameter in this...

How do you consume extra parameters in OAuth2 Token ...

My question is simply, is there a standard way to extend the login requirements for the OWIN OAuth2 token request to include more...