Jawbone API

Hi,

I'll keep this brief. I am attempting to use your class to connect to both the Fitbit API and the Jawbone API. Fitbit works fine as you had it set up by default.

Jawbone on the other hand is proving to be difficult. I have successfully set it up so that it is presenting the login screen and I am able to get to a page where it says 'Authorize this application', when I click accept it just loops and presents the same page again.

I am fairly sure this is to do with my script not recognising the code that has been passed back, and as such defaulting to the default redirect_uri.

This might also be to do with the way their token is accessed, below are my json details for the server. As you can see, the 'access_token_url' has a large number of parameters (as specified on https://jawbone.com/up/developer/authentication), this seems at odds with the rest of the servers on the list which all seem to have at most 1 parameter.


"Jawbone":
{
"oauth_version": "2.0",
"dialog_url": "https://jawbone.com/auth/oauth2/auth?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&scope={SCOPE}&response_type=code",
"access_token_url": "https://jawbone.com/auth/oauth2/token?client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}&grant_type=authorization_code&code={CODE}"
}

Any help would be appreciated.

Jack

The class uses sessions to store access tokens by default. If you are entering in a loop, it is possible that sessions are no working correctly in your PHP environment.

As for the access token URL, it is accessed via POST request, so all those parameters are passed via POST parameters instead of passing them via URL.

Okay, didn't realise about the post request. I've amended the url to ignore those parameters now.

As far as the session goes, I'm not really sure what could be going wrong. It works for Fitbit and the only difference is that this is using oauth 2.0 rather than 1.0.a.

For reference this is a var_dump of the current session.

Session Variables:
array(1) {
["OAUTH_STATE"]=>
string(17) "1409568010-e10e8b"
}

If I comment out the $this->Redirect($url); on line 2456 and then echo out the client class this is what I get.

oauth_client_class Object
(
[error] =>
[debug] => 1
[debug_http] => 1
[exit] => 1
[debug_output] => OAuth client: Checking if OAuth access token was already retrieved from https://jawbone.com/auth/oauth2/token
OAuth client: Checking the authentication state in URI /inc/oauth-api/login_with_jawbone?code=aV1SI82xvTq1wp95fipYXzuZbuotaed36EXgNP8CdZHsY7OIAD0EpH1oPaOzQ78T4675e9PR2JnD6u6cbRLabwJcUBjI6eiUmwPsZau6mE4qFHUbrwIyuWo0Z2LBaFf926_9J8ClH736u1YGuXQ4XW1HuTrvxQcUUySdMwlUTGFL2Cy6xs_J-Qx8gB6QCspv_mKMuaCh8JUKMkhcuUgu7_gavv0ztIiZ5PJTR5thIV1ItSTfK-zaEw
OAuth client: Redirecting to OAuth Dialog https://jawbone.com/auth/oauth2/auth?client_id={ID}&redirect_uri={REDIRECT_URI}&scope=basic_read+extended_read+move_read+generic_event_read&response_type=code

[debug_prefix] => OAuth client:
[server] => Jawbone
[configuration_file] => oauth_configuration.json
[request_token_url] =>
[dialog_url] => https://jawbone.com/auth/oauth2/auth?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&scope={SCOPE}&response_type=code
[offline_dialog_url] =>
[append_state_to_redirect_uri] =>
[access_token_url] => https://jawbone.com/auth/oauth2/token
[oauth_version] => 2.0
[url_parameters] =>
[authorization_header] => 1
[token_request_method] => GET
[signature_method] => HMAC-SHA1
[redirect_uri] => REDIRECT_URL
[client_id] => ID
[client_secret] => SECRET
[api_key] =>
[get_token_with_api_key] =>
[scope] => basic_read extended_read move_read generic_event_read
[offline] =>
[access_token] =>
[access_token_secret] =>
[access_token_expiry] =>
[access_token_type] =>
[default_access_token_type] =>
[access_token_parameter] =>
[access_token_response] =>
[store_access_token_response] =>
[access_token_authentication] =>
[refresh_token] =>
[access_token_error] =>
[authorization_error] =>
[response_status] => 0
[oauth_username] =>
[oauth_password] =>
[oauth_user_agent] => PHP-OAuth-API (http://www.phpclasses.org/oauth-api $Revision: 1.112 $)
)

The first redirect is necessary. So, if you disable it, you cannot see why the browser is returning to your site and it is redirected again.

Please enable PHP error log file and post its contents here to see what the class is logging when the browser after it returns from the dialog page.

Actually that was from after the redirect. I commented out the redirect code after I had performed the login handshake with Jawbone.

Anyway, I looked at the error log and it's empty. No errors are being generated by this page or its includes.

If you enabled the error log, it cannot be empty because the class dumps all the actions to the error log.

The matter is that what appears there is important to understand why it is in a loop.

Anyway, looking at the debug output you posted, it seems that server is not returning the state value that was passed to it. This way it is not possible to determine if the current user is really returning from an authorization flow or it is somebody trying to abuse your system.

So, it seems the problem is that your dialog URL is missing the state parameter. Try appending this: &state={STATE}

Hmm. I must have done something odd with the error log....

Anyways, adding the state parameter to the URL seems to have fixed it. Thanks a lot!

Hello,

Allow me to insert myself into the discussion because I also have a problem with Jawbone.

I have the same parameters:

$this->oauth_version = '2.0';
$this->dialog_url = 'https://jawbone.com/auth/oauth2/auth?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}&scope={SCOPE}&response_type=code&state={STATE}';
$this->access_token_url = 'https://jawbone.com/auth/oauth2/token?client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}&grant_type=authorization_code&code={CODE}';

My problem is this:
$client->access_token is empty in this code:
if(strlen($client->access_token))
{
$success = $client->CallAPI(
'https://jawbone.com/nudge/api/v.1.1/users/@me/body_events',
'GET',
array(),
array('FailOnAccessError'=>true),
$user
);
}

So CallAPI isn't executed and $user is undefined.

Can you help me please?

Jérôme Rigal

That's because the class did not succeed in getting the access token.

First the class redirects the browser to the Jawbone authorization page, so there is no token yet. Then the browser returns and the class sends a POST request to the token request URL. If it fails for some reason, the access token will still be empty.

You need to check the access_token_error variable to see what went wrong. You can also enable the error log variables and look at your PHP error log files to view the whole protocol dialog.

By the way, the access token URL should not have any GET variables in the URL because it is meant to be used as a POST request. The class will send those values as POST parameters.

Hello,

At first, I removed the GET variables in the access_token_url:
$this->access_token_url = 'https://jawbone.com/auth/oauth2/token';


Here are the contents of the error log:

[error] S {"error_description": "Invalid id/secret for client_id: [...]", "error": "unauthorized_client"}, referer: https://jawbone.com/auth/oauth2/auth?client_id=[...]&redirect_uri=https%3A%2F%2F[...]%2Ffr%2Fapi%2Fjawbone%2F&scope=basic_read+weight_read&response_type=code&state=[...]

Have you any idea of the problem?

Thanks