Twitter-Plugin OAuth: Help needed

Creating and modifying plugins.
Post Reply
User avatar
garvinhicking
Core Developer
Posts: 30020
Joined: Tue Sep 16, 2003 9:45 pm
Location: Cologne, Germany
Contact:

Twitter-Plugin OAuth: Help needed

Post by garvinhicking » Sat Sep 18, 2010 11:35 am

Hi!

(We can switch to german, if anyone prefers)

Silvio and his co-workers put some effort into the Twitter plugin (serendipity_plugin_twitter / serendipity_event_twitter) to make it compatible with 0Auth. This is a major change in how Twitter handles authentication to post tweets.

On their blog, they offered this update:

http://www.webmaster-tagebuch.de/2010/0 ... erung.html

which I turned into this:

http://dl.dropbox.com/u/1444910/serendi ... witter.tgz

This uses some basic OAuth code, but did a few things that needed changes. Especially the way how the consumer/token keys are saved in files (instead of the s9y database) and to make calls to the serendipity external_plugin hook instead of calling .php files directly (which would be a security-relevant issue).

I today tried to integrate my suggestions into the plugin, but soon got aware that it's hard to read the code when I've never worked with Twitter OAuth before.

I believe I properly exchanged all the code calls to storage files to a unified database storage, and also changed all code calls to be routed through external_plugin (i.e. /blog/index.php?/plugin/twitteroa_redirect).

One major problem of mine is that I do not understand how to properly "connect" the plugin on your blog with your twitter account. From what I figure, the plugin does this:

When first configuring the plugin, no consumer_key and consumer_secret is set, and also no oauth_token and oauth_token_secret. To do so, you must register the App with Twitter, and a callback URL is provided that you need to enter in twitter (now: /blog/index.php?/plugin/twitteroa_callback).

The twitter target page is: https://twitter.com/apps/new -- and that page looks so convoluted and hard to understand, that I wouldn't want any serendipity user to need to understand each field there. There must be some kind of "Challenge-Response" link, so that Serendipity users can click a link, and everything is handled through the API so that they only need to tell Twitter.com "Yes, I want this application to use my credentials", right?

Inside the plugin, everything's that's related to Twitter OAuth is in these lines:

1. Plugin introspection on line 348:

Code: Select all

            case 'twitteroa_consumer_key':
                $this->handleConfig('twitteroa_consumer_key', $propbag);
                break;
        
            case 'twitteroa_consumer_secret':
                $this->handleConfig('twitteroa_consumer_secret', $propbag);
                break;
                        
            case 'twitteroa_sign_in':
                $this->handleConfig('twitteroa_sign_in', $propbag);
                break;
I updated this code to be routed through a global "handleConfig" method. This makes it possible to re-use the code for multiple twitter identities. For now, let's now care about multiple identities though, and only talk about the one for a main account.

handleConfig is declared in line 170, and really only reads the database stored values, see if they exist, and depending on that return the configuration values.

The callback etc. handlers and routines can be found in lines 780 - 906. Those are mostly copies of the former .php files in Silvio's plugin variant. I only exchanged that keys/secrets are read from the database instead of stored files.

The actual OAuth confirmation/token responses are routed through here, so that's the heart of the authentication scheme that I don't properly get.

Calling the Twitter API is simply done like on line 1471:

Code: Select all

            $connection = $this->twitteroa_connect();

            /* statuses/update */
            $parameters = array('status' => $update);
            $status = $connection->post('statuses/update', $parameters);
The twitteroa_connect() method is declared on line 1452 earlier on, and also simply only reads the consumer/token keys/secrets.

Who's willing to take a dive and explain to me how the original OAuth token setup should take place?

Help is much appreciated. :-)

Regards,
Garvin
# Garvin Hicking (s9y Developer)
# Did I help you? Consider making me happy: http://wishes.garv.in/
# or use my PayPal account "paypal {at} supergarv (dot) de"
# My "other" hobby: http://flickr.garv.in/

mattsches
Regular
Posts: 440
Joined: Sat Nov 05, 2005 10:35 pm
Location: Wiesbaden, Germany
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by mattsches » Sat Sep 18, 2010 12:00 pm

First of all, I don't think there's an easy way to pre-fill the input fields in the new application form :| Afaik it's not possible to pass parameters to that form. It's probably best to assemble all the necessary URLs and stuff in S9y and present them to the user on the plugin page, like this
So the user can copy & paste all the info into the form. I checked the docs of some WP plugins, and they seem to handle it likewise.

I will take a look at the rest of the code as soon as I can .. have to go shopping now :wink:

- mattsches

User avatar
garvinhicking
Core Developer
Posts: 30020
Joined: Tue Sep 16, 2003 9:45 pm
Location: Cologne, Germany
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by garvinhicking » Mon Sep 20, 2010 2:41 pm

Hi!

Thanks a lot for everyone's help. I've posted an update to the plugin:

http://garv.in/serendipity/archives/139 ... OAuth.html (german)

The plugin file is available here:

http://dl.dropbox.com/u/1444910/serendi ... witter.zip

Please give feedback :)
# Garvin Hicking (s9y Developer)
# Did I help you? Consider making me happy: http://wishes.garv.in/
# or use my PayPal account "paypal {at} supergarv (dot) de"
# My "other" hobby: http://flickr.garv.in/

User avatar
yellowled
Regular
Posts: 7036
Joined: Fri Jan 13, 2006 12:46 pm
Location: Eutin, Germany
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by yellowled » Mon Sep 20, 2010 4:59 pm

garvinhicking wrote:Please give feedback :)
Plugin config is rather cumbersome, but that seems unavoidable with Twitter calling the shots in this area. Other than that, I just posted a test entry which was announced via twitter without any noticable problems.

Yay, good job! :)

YL
amazon Wishlist - Serendipity-Podcast (German only, sorry)

akremedy
Regular
Posts: 56
Joined: Sat Jul 26, 2008 9:06 am
Location: Bay Area, U.S.A.
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by akremedy » Mon Sep 27, 2010 9:03 am

This is odd, it took some hunting, but I found a link to twitter.com/apps/new in white text between "After you have entered those values..." and "Consumer key". This should be black or blue text (URL) I'm sure, right?

This is straight from firebug:

Code: Select all

<a target="_blank" href="http://twitter.com/apps/new" style="color: rgb(255, 255, 255); padding-left: 30px;">Register</a>
Also, with this new OAuth scheme, it seems as though running S9Y with this plugin behind a firewall on private IP's/server names won't be an option? For example, my test server runs as localhost. I didn't go through all of the setup, I'll try it out tomorrow on my production site and use OAuth parameters given there to generate my consumer key and consumer secret. I'm fearful right now of messing up my account by giving all the localhost references. If this is a real concern, then there should be a warning included with the plugin, however, if it is not a concern, then no worries.

At face value, I'm not really finding it to be any more or less complicated than the previous version. Except for the instructions to setup an OAuth account, it's all basically the same - as such, the defaults probably good enough for most people (they were good enough for me).

Thanks for tackling this one, I trust it has not been an easy exercise!

User avatar
garvinhicking
Core Developer
Posts: 30020
Joined: Tue Sep 16, 2003 9:45 pm
Location: Cologne, Germany
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by garvinhicking » Mon Sep 27, 2010 10:37 am

Hi!

I think the button should usually be a graphic! Did you check the configuration of the twitter plugin if the HTTP path there is properly leading to the plugin's HTTP path? The white text is only there as a fallback for disabled people's browser reading links.
Also, with this new OAuth scheme, it seems as though running S9Y with this plugin behind a firewall on private IP's/server names won't be an option? For example, my test server runs as localhost. I didn't go through all of the setup, I'll try it out tomorrow on my production site and use OAuth parameters given there to generate my consumer key and consumer secret. I'm fearful right now of messing up my account by giving all the localhost references. If this is a real concern, then there should be a warning included with the plugin, however, if it is not a concern, then no worries.
This should still work. The Callback URL is only required for redirecting to your blog, so if you have a valid URL you can use personally, you will be forwarded to the proper URL.

OAuth is the only way to post to twitter now, so if you cannot use it due to the firewall setup, you cannot use any twitter plugin at all. This is not a s9y-specific issue... But anyhow, it should work due to you being able to call the callback URL, and not Twitter itself.
Thanks for tackling this one, I trust it has not been an easy exercise!
It was quite fun, though! :-)

Regards,
Garvin
# Garvin Hicking (s9y Developer)
# Did I help you? Consider making me happy: http://wishes.garv.in/
# or use my PayPal account "paypal {at} supergarv (dot) de"
# My "other" hobby: http://flickr.garv.in/

akremedy
Regular
Posts: 56
Joined: Sat Jul 26, 2008 9:06 am
Location: Bay Area, U.S.A.
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by akremedy » Mon Sep 27, 2010 7:31 pm

Ah, and you're right on both accounts, the button should be a graphic (and is, provided the plugin path is set correctly). And, the plugin path in my case was giving the full path windows path - changed to the http relative path and all is well. I guess I didn't look hard enough to discover that config problem after the install and fix it then :oops:

Good to know about the callback and such. I plan to install then new version in production now.

Thanks!
Adam

akremedy
Regular
Posts: 56
Joined: Sat Jul 26, 2008 9:06 am
Location: Bay Area, U.S.A.
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by akremedy » Wed Sep 29, 2010 7:47 am

It looks like all is working on this end, though it took a couple of passes to get everything setup so that it functions as expected. I think this is mainly the result of fatigue and too many late nights though. Attempt 1 - forgot to set options in Article Announcement tab to Tweet new articles. Attempt 2 - failed to realize that after establishing OAuth account and inserting generated keys in the plugin config, you must "Sign In" on the plugin config page/Identities tab.

All is well now though :D

User avatar
blog.brockha.us
Regular
Posts: 695
Joined: Tue Jul 03, 2007 3:34 am
Location: Berlin, Germany
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by blog.brockha.us » Mon Nov 22, 2010 8:14 pm

Well.. Reporting somewhat back to work. ;)

I'm in the process of "reloading" my blog. I updated the microblogging plugin, too.
First to say: Good work, folks!
I have some problems in establishing the OAuth mechanism, but I will discuss this in another thread.

While looking at the new microblogging plugin one question came into my mind: Why do I have to register the application over and over again for each twitter account and for all s9y blogs? Why don't we declare/register the plugin as one application (like all other clients do it), store the secrets inside of the code and let the user only grant access to the specific account?

That would ease the pain of installing the OAuth a lot I guess and we don't have thousands of apps registered at twitter, while it is only one app in fact.

Am I thinking to short in this?
- Grischa Brockhaus - http://blog.brockha.us
- Want to make me happy? http://wishes.brockha.us/

User avatar
Don Chambers
Regular
Posts: 3633
Joined: Mon Feb 13, 2006 3:40 am
Location: Chicago, IL, USA
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by Don Chambers » Mon Nov 22, 2010 8:24 pm

I cannot answer your question, but I would like to say "welcome back"!!

User avatar
blog.brockha.us
Regular
Posts: 695
Joined: Tue Jul 03, 2007 3:34 am
Location: Berlin, Germany
Contact:

Re: Twitter-Plugin OAuth: Help needed

Post by blog.brockha.us » Mon Nov 22, 2010 8:39 pm

Thanks a lot, Don. :)
- Grischa Brockhaus - http://blog.brockha.us
- Want to make me happy? http://wishes.brockha.us/

Post Reply