LinkedIn OAuth：请求 POST HTTP 请求时的“signature_invalid”响应（用于请求令牌）

Question

当我从 LinkedIn 向 https://api.linkedin.com/uas/oauth/requestToken 请求请求令牌时，我收到以下错误：

oauth_problem=signature_invalid&oauth_problem_advice=com.linkedin.security.auth.pub.LoginDeniedInvalidAuthTokenException%20while%20obtaining%20request%20token%20for%20%3APOST%26https%253A%252F%252Fapi.linkedin.com%252Fuas%252Foauth%2Foauth%2 ％26oauth_callback％253Doob％2526oauth_consumer_key％253DI9DvH3zT4c-sjmrQTmo_AeJOfi8v8n1ChYHYAV8A3siVLyu1qLZqPq_HiGecD0bp％2526oauth_nonce％253D2958724240022％2526oauth_signature_method％253DHMAC-SHA1％2526oauth_timestamp％253D1308562221％2526oauth_version％253D1.0％0AOAU％3AI9DvH3zT4c-sjmrQTmo_AeJOfi8v8n1ChYHYAV8A3siVLyu1qLZqPq_HiGecD0bp％7C％2A01％7C％2A01％7C％2A01％3A1308562221 %3AkPisU0TwUgiNIYpigUrKITMwo7c%3D

这是未经授权的 HTTP 401 响应。

例外：

net.oauth.exception.OAuthException: HTTP/1.0 401 Unauthorized
oauth_problem=signature_invalid&oauth_problem_advice=com.linkedin.security.auth.pub.LoginDeniedInvalidAuthTokenException%20while%20obtaining%20request%20token%20for%20%3APOST%26https%253A%252F%252Fapi.linkedin.com%252Fuas%252Foauth%252FrequestToken%26oauth_callback%253Doob%2526oauth_consumer_key%253DI9DvH3zT4c-sjmrQTmo_AeJOfi8v8n1ChYHYAV8A3siVLyu1qLZqPq_HiGecD0bp%2526oauth_nonce%253D2958724240022%2526oauth_signature_method%253DHMAC-SHA1%2526oauth_timestamp%253D1308562221%2526oauth_version%253D1.0%0AOAU%3AI9DvH3zT4c-sjmrQTmo_AeJOfi8v8n1ChYHYAV8A3siVLyu1qLZqPq_HiGecD0bp%7C%2A01%7C%2A01%7C%2A01%3A1308562221%3AkPisU0TwUgiNIYpigUrKITMwo7c%3D
    at net.oauth.consumer.OAuth1Consumer.requestUnauthorizedToken(OAuth1Consumer.java:133)
    at com.neurologic.example.LinkedInExample.requestUnauthorizedRequestToken(LinkedInExample.java:39)
    at com.neurologic.example.LinkedInExample.main(LinkedInExample.java:57)

连接LinkedIn的示例源代码：

/**
 * 
 */
package com.neurologic.example;

import net.oauth.consumer.OAuth1Consumer;
import net.oauth.exception.OAuthException;
import net.oauth.provider.OAuth1ServiceProvider;
import net.oauth.signature.impl.OAuthHmacSha1Signature;
import net.oauth.token.v1.AccessToken;
import net.oauth.token.v1.AuthorizedToken;
import net.oauth.token.v1.RequestToken;

/**
 * @author Buhake Sindi
 * @since 14 June 2011
 *
 */
public class LinkedInExample {

    private static final String LINKEDIN_API_URL = "https://api.linkedin.com";
    private static final String API_KEY = "ENTER-API-KEY-HERE";
    private static final String API_SECRET  = "ENTER-API-SECRET-HERE";
    private static final String CALLBACK_URL = "oob";
    private OAuth1Consumer consumer;


    /**
     * 
     */
    public LinkedInExample() {
        super();
        // TODO Auto-generated constructor stub
        consumer = new OAuth1Consumer(API_KEY, API_SECRET, new OAuth1ServiceProvider(LINKEDIN_API_URL + "/uas/oauth/requestToken", LINKEDIN_API_URL + "/uas/oauth/authorize", LINKEDIN_API_URL + "/uas/oauth/accessToken"));
    }

    public RequestToken requestUnauthorizedRequestToken() throws OAuthException {
        return consumer.requestUnauthorizedToken(LINKEDIN_API_URL, CALLBACK_URL, null, new OAuthHmacSha1Signature());
    }

    public String getAuthorizationUrl(RequestToken token) throws OAuthException {
        return consumer.createOAuthUserAuthorizationUrl(token, null);
    }

    public AccessToken requestAccessToken(AuthorizedToken authorizedToken, RequestToken requestToken) throws OAuthException {
        return consumer.requestAccessToken(LINKEDIN_API_URL, requestToken, authorizedToken, new OAuthHmacSha1Signature());
    }

    /**
     * @param args
     */
    public static void main(String[] args) {
        // TODO Auto-generated method stub
        try {
            LinkedInExample example = new LinkedInExample();
            RequestToken rt = example.requestUnauthorizedRequestToken();

            //Now that we have request token, let's authorize it....
            String url = example.getAuthorizationUrl(rt);

            //Copy the URL to your browser and make sure that OAuth 1 Servlet is running....
        } catch (OAuthException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
    }

}

我的图书馆：JOAuth（1.2.1 版）。从 LinkedIn 返回 com.linkedin.security.auth.pub.LoginDeniedInvalidAuthTokenException 建议我做错了什么？

谢谢

PS： OAuth 1 与 Twitter 完美配合（经过测试），因此我不明白发生了什么。此外，LinkedIn 使用 JOAuth 符合的 OAuth 1.0 Revision A（以及 RFC5849）。

Answer 1

似乎 JOAuth 库没有正确计算签名。我需要查看完整的请求和响应才能进一步调试。您的应用程序名称是什么？

Answer 2

请参考我对Absolute minimum code to get a valid oauth_signature populated in Java or Groovy?的回复 也许会有所帮助:)

Answer 3

我想通了。问题在于标准化基本字符串 URI。 URI 的路径不能是小写的（我的路径是小写的）。我已经解决了这个问题。问题出在net.oauth.util.OAuth1Util.normalizeUrl() 方法中的方法中。