How can you sign a POST with OAuth1.0a using scala

Question

I'm trying to implement an LTI Launch Request (http://www.imsglobal.org/LTI/v1p1/ltiIMGv1p1.html) using Scala and Play 2.2.0. It is basically a HTTP POST with form parameters and an OAuth signature.

I can successfully sign the POST but only if the POST body is not added. The 'OAuthCalculator' class doesn't seem to use the POST body when calculating the signature.

This doesn't calculate the correct signature.

    val params = Map(
            "lti_message_type" -> Seq("basic-lti-launch-request"),
            "lti_version" -> Seq("LTI-1p0"),
            "launch_presentation_return_url" -> Seq("http://lms.com"),
            "resource_link_id" -> Seq("1023"))

            WS.url("http://myservice:56024/widget")
              .sign(OAuthCalculator(key, RequestToken(null, null)))
              .post(params)

It does correctly calculate them if no body is given to the POST.

    WS.url("http://myservice:56024/widget")
      .sign(OAuthCalculator(key, RequestToken(null, null)))
      .post("")

I am purposefully passing an empty request token because I want the calculator to perform OAuth signing only.

Is there another method of adding the POST body or another way to get the library to sign the request?

Answer 1

It does not seem possible for OAuth Signpost to sign POST parameters included in the message body with the standard HTTP request library used in Scala Play 2.0. https://code.google.com/p/oauth-signpost/wiki/GettingStarted#Signing_an_HTTP_message_using_OAuthConsumer see note in section that described why it cannot include the POST message body in the signing.

I worked around this by using the Apache HTTP client to make a synchronous call.

    val params = new util.ArrayList[BasicNameValuePair](1)
    params.add(new BasicNameValuePair("lti_message_type", "basic-lti-launch-request")

    val consumer = new CommonsHttpOauthConsumer("key", "secret")

    val post = new HttpPost("http://stackoverflow.com:8080/service")
    post.addHeader("Content-Type", "application/x-www-form-urlencoded")
    post.setEntity(new UrlEncodedFormEntity(params))

    consumer.sign(post)