Magento 1: Where is oauth_admin.php

Question

The rest documentation for Magento 1 make mention of an oauth_admin.php file

$callbackUrl = "http://yourhost/oauth_admin.php";
$temporaryCredentialsRequestUrl = "http://yourhost/oauth/initiate?oauth_callback=" . urlencode($callbackUrl);
$adminAuthorizationUrl = 'http://yourhost/admin/oAuth_authorize';
$accessTokenRequestUrl = 'http://yourhost/oauth/token';
$apiUrl = 'http://yourhost/api/rest';
$consumerKey = 'yourconsumerkey';
$consumerSecret = 'yourconsumersecret';

This appears to be the file/URL that oauth will redirect to after the User Authorization step.

The docs fails to clearly say what this oauth_admin.php program/script needs to do with the oauth_token and and oauth_verifier variables it receives in order to work with the rest of the code sample.

Does this file exist anywhere in the docs and/or elsewhere? If not is there known science for getting Magento 1's three legged oauth working?

Answer 1

oauth_admin.php is just a stand-alone PHP Oauth client script which can be your callbackurl. You can replace this with your controller and action url path. Its involved in all the three legged authentication.

So the very file which you have pasted and find here in the doc is the actual oauth_admin.php

A quick overview of the Three legged authentication in this file

1. Get the initial temporary request token.

    $oauthClient = new OAuth($consumerKey, $consumerSecret, OAUTH_SIG_METHOD_HMACSHA1, $authType);
    $oauthClient->enableDebug(); 

    // it returns an array with two values oauth_token (request token) and oauth_token_secret , eventually both of these will be used to get the access token and secret
    $requestToken = $oauthClient->getRequestToken($temporaryCredentialsRequestUrl);

2. Validate and confirm / reject the admin Oauth authorization request.

   // where $adminAuthorizationUrl is http://magentohost/admin/oauth_authorize and oauth_token is the request token
   header('Location: ' . $adminAuthorizationUrl . '?oauth_token=' . $requestToken['oauth_token']);

3. Exchange the temporary request token and secret to get the final access token and secret, which enables the user to access the resources they are allowed to access.

     $oauthClient->setToken($_GET['oauth_token'], $_SESSION['secret']);
     $accessToken = $oauthClient->getAccessToken($accessTokenRequestUrl);

In this script, you can find the values are persisted in the session to remember the authentication step and the request and access tokens with their secret tokens.

Similar to the admin user, the customer is also allowed to access the resources allowed for them. In this case, only the authorization url is different http://magentohost/oauth/authorize

Mage_Oauth module handles all the Oauth requests and responds appropriately.

Answer 2

The oauth_token and oath_verifier is used to retrieve the oath_access_token That will be used for your subsequent requests to query products etc.

$stack = HandlerStack::create();
$middleware = new Oauth1([
    'callback' => 'https://myapp.dev/not-magento-url/',
    'consumer_key' => $consumerKey,
    'consumer_secret' => $consumerSecret,
    'token' => $token,
    'token_secret' => $tokenSecret,
    'verifier' => $verifier,
]);

$stack->push($middleware);

// Client here is a GuzzleHttp\Client
$client = new Client([
    'base_uri' => $magentoApiBaseUrl,
    'handler' => $stack,
]);

$response = $client->post('oauth/token', [
    'auth' => 'oauth',
    'allow_redirects' => true,
]);

// response should contain the access token / details needed