The different strategies ship with tmhOAuth by @themattharris which is a composer installable library as well.

• This dependency should be required in your composer.json, NOT shipped with your code
• You're hard-coding this dependency in a constructor instead of injecting it
• Your code is using an outdated version of that dependency
• You're overriding the secure defaults of that dependency, eg. curl_ssl_verifypeer, which should NEVER be 'false'

$opauth = new Opauth($config, false);
$opauth->runStrategy($strategy); // index

$opauth = new Opauth($config, false);
$opauth->runStrategy($strategy, $action);

Hi All -

I just did a fresh out of the box install on a LAMP server. I'm unable to get Google and Twitter working. I get an error on the callback.php page:

Notice: Undefined index: opauth in /var/www/opauth/callback.php on line 50
Warning: array_key_exists() expects parameter 2 to be array, null given in /var/www/opauth/callback.php on line 67
Invalid auth response: Missing key auth response components.

I'm having a hard time tracking down the error. So far I have tried/tested everything on nginx/php also, and am getting the same results. I was able to get Facebook to work (pretty simple & out of the box).

Has anyone else seen problems like this? I setup a completely new EC2 server, just to verify my other configuration was doing the same thing. So I'm able to reproduce the problem on 2 servers. Pretty minimal configs...nothing at all special.

Any ideas on what I can troubleshoot next?

Hello, I'm trying to setup the library on Laravel4.

Why is it that it POST to the right callback url with 301 on it, and then redirects back to the callback url using this time a GET request.

I feel everything are setup just fine.

Let me know if you have some insights to where should I look next.

Thanks much.

As symfony has it's own session management and uses the HttpFoundation component to send the response (and the headers). We can't just exit in the middle of the request.

This PR makes this possible assigning to response object to symfony_response in the config. This will be adjusted by Opauth and the controller can return this.

This will make this package usable for all frameworks using the HttpFoundation component

If you have any remarks/notes to my changes, let me know.

I am very new to this and when I followed the instructions and clicked on facebook link in example, I am getting the "localhost/facebook" not found error.

I have the app id and secret installed properly and have downloaded the facebook strategy to lib/Opauth/Strategy/Facebook folder.

Am I missing something?

It would be swell if, instead of relying on allow_url_fopen, or any particular underlying HTTP transport, if a pluggable system could be added instead. One with adapters for Guzzle, Zend_Http, and others.

This way, the consumer could use their preferred library for handling HTTP transport instead of requiring you to define one specifically.

Inversion of control, FTW!

Hi U-Zyn,

I created new strategy for Yahoo! JAPAN OAuth 2.0 implementation,
and it needs to set additional HTTP Authorizaton Header for Access Token Request.

Authorization: Basic (Base64 encoded Client Credentials)

I call serverPost method using options parameter in strategy file.
YahoojpStrategy.php

$options = array(
    'http' => array(
        'header' => "Content-type: application/x-www-form-urlencoded\r\n".
                    "Authorization: Basic ".base64_encode($this->strategy['client_id'] . ':' . $this->strategy['client_secret'])
    )
);

However, OpauthStrategy seems to overwrite the $options['http'] with default value by array_merge.
Current OpauthStrategy.php

$stream = array_merge($options, $stream);

I changed this logic. If $options has 'http' array, it overwrites default stream with optional value.

Thanks. Ryo.

I ran into this problem and it took a lot of time to find the problem. Maybe you could throw an error if allow_url_fopen = Off or you can use cURL in that case.

Here is my dirty quick fix: if (ini_get('allow_url_fopen')) { $content = file_get_contents($url, false, $context); } else { $ch = curl_init(); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_URL, $url); $content = curl_exec($ch); curl_close($ch); }

I know that there's a reluctance for cURL support as it will make it a direct dependency and the idea is to avoid that.

However, this has been added in a way that simply makes it an enhancement if it's available, rather than a hard dependency.

This adds some flexibility to the library and adds some support for a pretty common php module that I think would be worthwhile

cc @willmorgan

Hi

I have this error after connect with facebook.

Note: Application should set callback URL to application-side for further specific authentication process. Authentication error: Opauth returns error auth response.

Array ( [error] => Array ( [provider] => Facebook [code] => access_token_error [message] => Failed when attempting to obtain access token [raw] => )

[timestamp] => 2014-04-03T02:10:22-07:00

)

Warning: array_key_exists() expects parameter 2 to be array, null given in /var/home/www/demo/app/controllers/socialauth.php on line 42 Invalid auth response: Missing key auth response components.

Any suggestion?

Thanks!!

I am hardly even developing in PHP now these days so it's getting difficult for me to maintain a PHP project.

Opauth has been unmaintained for awhile now.

The other core members, @ceeram and @t1mmen, are not keen to take the lead in Opauth. Would anyone be interested in taking the lead in Opauth?

I created gitlab strategy and it could be added to this opauth repo here's new strategy https://github.com/ppatrik/opauth-gitlab Tested with GitLab CE 8.7.0

opauth is an incredibly useful tool _ thank you so much for putting this up.

Question: i'm using the user email address as a way to detect which user logged in, which is fine for Facebook, Google and Github; providing the user used the same email address on any of these providers, he is recognized.

But Twitter does not return the user email address, which is ennoying because I don't see any way I could match a user that would have register using his facebook account, and who tries to log in via his twitter account. I've looked in the Twitter raw response and I don't see any field that could be used to reliably identify a user who would have previously logged in via Facebook/G+ or Github.

As far as i know, the only unique identifier Twitter uses is the "nickname", which does not exist in the other providers response.

What would be a good work around?