What am I missing with OAuth token exchange process?

Question

Magento has two important documents that outline how OAuth 1.0a authentication/authorization works (here and here). There also appears to be a Magento sponsored example of OAuth.

There are two important steps:

1. Server to server POST for initial OAuth key exchange to the Callback URL. oauth_consumer_key, oauth_consumer_secret, oauth_verifier, and store_base_url are sent.
2. User is redirected with a GET to the Identity Link URL. consumer_id and success_call_back are sent.

How in the world are #1 and #2 connected?

I don't see any common data and the example from Magento just uses a common session, which I can only assume is a horrible idea. Even more confusing is why consumer_id is sent with the user.

Answer 1

This issue is resolved in the latest version of https://github.com/magento/magento2 (and will be available in 2.1.0 I suppose).

Now consumer_id is replaced with oauth_consumer_key in all requests. And thus oauth_consumer_key can be used as correlation ID. Here is a fork of the original example you mentioned. This fork is compatible with the latest version of Magento 2.

Answer 2

To me it looks like the example is wrong. Not sure how you found out it was a "Magento sponsored example" by the way.

The first step you mentionned is right, that is the activation step.

However the second step is wrong as there is no need to send the consumer_id (you can clearly see that this variable is not even used in the checklogin.php script).

On top of that, the use of this variable is never mentionned in the official documentation so I reckon that was mostly for testing purpose.

My advice is to stick to the official doc, scripts found online can sometimes be misleading.