Refreshing an Access Token

[slee]

I've been testing the sample application against my own server, as
well as a public oauth test server at http://oauth-sandbox.mediamatic.nl/.
Everything seems to be working fine (I can get a request token,
authorize, and get an access token), until restarting the app, where
the app retrieves the tokens from the keychain, and automatically
refreshes the access token. I get a similar error on both servers
while trying to refresh the access token, which causes the
MPOAuthNotificationAccessTokenRefreshed notification to never be
sent. Is anyone else seeing this?

[slee]

BTW, I'm on r113

On Apr 10, 9:58 am, slee <lee.sunh...@gmail.com> wrote:
> I've been testing the sample application against my own server, as

> well as a public oauth test server athttp://oauth-sandbox.mediamatic.nl/.

[Karl Adam]

What error are you getting exactly? If you run the app with the
framework in debug mode it will print out every URL as it loads to
help you in debugging errors.

_Karl

[slee]

The error from the server says that the consumer_key/token combination
doesn't exist, or is not enabled, however, I can see that the token
does exist, and is enabled for that consumer key. I think the problem
is that the token being sent is an access_token, and the server is
looking for a request_token to match the consumer_key.

On Apr 10, 11:28 am, Karl Adam <karla...@mac.com> wrote:
> What error are you getting exactly? If you run the app with the  
> framework in debug mode it will print out every URL as it loads to  
> help you in debugging errors.
>
> _Karl
>
> On Apr 10, 2009, at 09:58:25, slee wrote:
>
>
>
> > I've been testing the sample application against my own server, as

> > well as a public oauth test server athttp://oauth-sandbox.mediamatic.nl/

[Karl Adam]

If that were the case then that's a server side error as this is how
OAuth is meant to be used, you use a request token once and only once
to request user access, and once the user has granted that access
you're given an access token to use from then on. If the testing
server is misconfigured for this we should contact the owner of the
server as it's not doing what people expect.

_Karl

[slee]

Ok, just contacted the guys on the server end of things. They claim
that refreshing an access token with an old token should be supported,
and are looking into the error that I'm getting. So it may be a
server side error as you said. However I was receiving a similar
error on two completely separate service providers, so I'm still
investigating if it's on my end.

Is there anyway to reset the device keychain so that I can properly
test this flow again? I've tried to programmatically remove them by
calling the removeValueFromKeychainUsingName: method in MPOAuthAPI,
but it doesn't seem to have an effect. Is there something else I need
to call to make the changes persist?

[slee]

The server side issue has now been resolved and I'm receiving a
refreshed access token, however I'm still not getting an
MPOAuthNotificationAccessTokenRefreshed notification. I'm stepping
through the code, and on line:200 of MPOAuthAPIRequestLoader.m, the
contents of the if statement is being skipped because
self.credentials.requestToken still has a value. This may be related
to my previous question as to why the keychain values are not being
removed properly.

[Karl Adam]

Okay, do you mind sharing the code that you're using in particular? My
tests are coming up fine so I may need to add some unit tests around
the way you're using it along with assertions to capture that behavior
for others when it happens.

[slee]

Code for removing keychain values? I just added the following lines
at line #60 of MPOAuthAPI.m:

[self removeValueFromKeychainUsingName:@"oauth_token_request"];
[self removeValueFromKeychainUsingName:@"oauth_token_request_secret"];
[self removeValueFromKeychainUsingName:@"oauth_token_access"];
[self removeValueFromKeychainUsingName:@"oauth_token_access_secret"];
[self removeValueFromKeychainUsingName:@"oauth_session_handle"];

And then checked the values at line #70.

[Karl Adam]

No, I mean the code that you have using MPOAuthAPI, not your changes
to MPOAuthAPI. If you've already got preexisting changes to the source
itself, that may explain why we're getting different results from the
same server endpoints.

_Karl

[slee]

No, I haven't changed any code to MPOAuthAPI, the keychain code was
just used as a test and removed immediately.