5

I have been able to successfully get an access token from Vimeo using the Scribe API.

However, when I try to access a protected resource, I get an invalid signature error. My OAuthService that I use to try an access a protected resource, looks like: 

OAuthService service = new ServiceBuilder()
    .provider(VimeoApi.class)
    .apiKey(APIKEY)
    .apiSecret(API_SECRET)
    .signatureType(SignatureType.QueryString)
    .build();

Then, I make a request doing the following:

  OAuthRequest orequest = new OAuthRequest(Verb.GET, "http://vimeo.com/api/rest/v2");
  orequest.addBodyParameter("method", "vimeo.videos.upload.getQuota");

This fails and tell me that the signature is invalid.

stevebot
  • 23,275
  • 29
  • 119
  • 181
  • 1
    The method param will be part of the signature, since all OAuth parameters are sorted, encoded and added to the base string. How do you know that's not part of the signature? – Pablo Fernandez Dec 16 '11 at 16:43
  • @Pablo you're right! I used the BaseStringExtractImpl and see the parameter. Thanks man. I'm not sure why it's telling me the signature is invalid, do you have any thoughts? – stevebot Dec 16 '11 at 17:11
  • @Pablo It doesn't make sense to me that this isn't working. I seem to be passing all the valid parameters to Scribe. – stevebot Dec 16 '11 at 22:51
  • 1
    If you can, please use scribe 1.3.0 which has a brand new `debug` method you can use for further digging. – Pablo Fernandez Dec 17 '11 at 01:06
  • @Pablo thanks, I set debug, and everything looked correct. Are you able to access restricted uri's in the vimeo api with scribe? – stevebot Dec 19 '11 at 06:28
  • @Pablo It seems that Scribe should not include the parameters in a GET request body as part of the base string, would you agree? According to the Oauth specification, GET request body parameters should not be included. – stevebot Dec 21 '11 at 22:21

1 Answers1

3

The problem is,

  orequest.addBodyParameter("method", "vimeo.videos.upload.getQuota");

Scribe then added this parameter to the base string used to form the signature. Vimeo saw that I was doing a GET and that the method parameter was in the request body and not query string, so it did not include it in the base string. Hence, the signature Vimeo expected was different than the one Scribe generated.

I am doing a GET however so I should be passing this parameter on the query string,

  orequest.addQuerystringParameter("method", "vimeo.videos.upload.getQuota");

This works, as would:

  OAuthRequest orequest = new OAuthRequest(Verb.POST, "http://vimeo.com/api/rest/v2");
  orequest.addBodyParameter("method", "vimeo.videos.upload.getQuota");
stevebot
  • 23,275
  • 29
  • 119
  • 181