Blackening999 / passport-linkedin-token-oauth2

This is the plugin for torii and passport integration
MIT License
8 stars 7 forks source link

didn't work for me.. fixed #1

Closed simllll closed 9 years ago

simllll commented 9 years ago

hi, it didn't work for me, I alway got that the access token is invalid.

Therefore I looked into the code, and even though I haven't fulled understand what's going on I found a way that it started working.

I haven't seen any auth code exchange part in the code, therefore I assumed that this wasn't happening at all. And I was right I guess, what I did was following modification:

around line 87 (before the "self._loadUserProfile(..)" call I added:

// NEW CODE
  options = {grant_type: 'authorization_code', 'redirect_uri': 'http://localhost'};

  this._oauth2.getOAuthAccessToken(accessToken, options,
          function(err, accessToken, refreshToken, options) {
            if (err) { return self.error(self._createOAuthError('Failed to obtain access token', err)); }
// NEW CODE END
// OLD CODE
          self._loadUserProfile(accessToken, function(err, profile) {
            if (err) { return self.fail(err); };

            function verified(err, user, info) {
              if (err) { return self.error(err); }
              if (!user) { return self.fail(info); }
              self.success(user, info);
            }

            if (self._passReqToCallback) {
              self._verify(req, accessToken, refreshToken, profile, verified);
            } else {
              self._verify(accessToken, refreshToken, profile, verified);
            }
          });
// OLD CODE END
// NEW CODE
  });
// NEW CODE END

hope it helps someone, please try to reproduce it and fix it in case you do ;)

thanks regards Simon

Blackening999 commented 9 years ago

@simllll Hello!

Thanks for trying this library first of all. I have created it for my own use didn't thought anyone could try it :)

You're right about the issue and solution. I'm using this library internally in my sails project and I forgot to describe that you should authenticate in scope of getOAuthAccessToken callback and pass options to it.

However, it isn't intended behaviour to put this method inside library. I will update README with 'how to use' and will add this section.

Thanks for your efforts in solving this issue and have a good day!

simllll commented 9 years ago

alright, thanks man :)

I started with the passport-facebook-token, there it works (somehow I cannot see why though ^^). Anyway, I thought this one is basically the same, just with linkedin, isn't it?

Just to explain what I actually do: I open the authorization page in an android app, take the generated authentication token. Pass it to the server, and the server should do the login. This works now so far for facebook (out of the box) and linkedin (after this fix). For OAuth1.0 it could be a bit more painful, we will see ;).

regards

Blackening999 commented 9 years ago

Yeah :) The main idea of this library was to reproduce the same library for facebook since there no any existing libraries on the web for linkedin.

For facebook-token you have to get access token first also.

You can take a look at updated README in 30-50 mins ;) and will understand more how it works if you're interested.

OAuth 1.0 for linkedin is a great pain the ass :) Fortunately it will extinct soon

Best Regards

simllll commented 9 years ago

Okay I will do that, but anyway I have already an access token when I call your library. Basically, accoding to this doc I need everything from step 3 onward: "Step 3 — Exchange Authorization Code for a Request Token" https://developer.linkedin.com/docs/oauth2

I got the authorization code from the authorize dialog (from the client), and now I need to exchange it for a request token. If I have to do the exchange manually, I don't understand why I have to pass the auth secret to this module?

regards

Blackening999 commented 9 years ago

Well, you have to perform request to linkedIn before authenticating (see updated ReadMe), in order to recognise your app you have to pass this info alongside with other required options. So it consists of 2 steps:

1) Exchange authorization code for access token 2) Load user profile using access token (what this library helps with)

I can understand your concerns - why I have to exchange for token at last? This is because, no library exists which working with tokens now out of the box.

Updated ReadMe will show enough to understand how everything works.

Regards