OAuth signature verification

OAuth signature verification

by Valerio Cattaneo -
Number of replies: 0

Hi everybody.

I have an LMS, totally custom, that is based on Classic ASP. I need to configure it as a simple LTI external tool for Moodle. The version of Moodle that I have to integrate with our LMS is 3.9.11. 

The only two operations that I have to manage are:

  1. receiving data from Moodle, related to user profiles and enrolments in courses.
  2. sending the grade obtained to Moodle, at the end of the exam.

I have developed a web page for the first task and it correctly receives and manages requests from Moodle, but I cannot verify the OAuth signature. I am totally new to OAuth, then I made some attempts.

First of all, I receive a request with some fields that are related to OAuth. The first I have noticed is 

oauth_version=1.0

Then I have supposed that I have to use OAuth1 and not OAuth2. Is it correct?

The other fields, related to OAuth, that I receive are the following:

  1. oauth_version=1.0
  2. auth_nonce=e99d305d35c66bb945649fab1a8f698d
  3. oauth_timestamp=1642579451
  4. oauth_consumer_key=**********
  5. oauth_signature_method=HMAC-SHA1
  6. oauth_signature=XXXXXX
I have an ActiveX object called Chilkat and I use this syntax in VBScript to instantiate this object
set oauth = Server.CreateObject("Chilkat_9_5_0.OAuth1")
Using this ActiveX, based on this example, I generate a signature that absolutely doesn't match with the one provided by Moodle in the oauth_signature field.
I see that the signature changes if I change the parameter oauth.OauthUrl
I don't know how to populate this parameter. I guessed it was my landing page, but it's not.
Can you please help me?
Thank you.
Valerio


                        

    
    
    
                            
    
    
                                

                                        
Average of ratings:  -