Password and OAuth

sayontan

Hi,
I am the author of a plugin called Photonic for WordPress, which helps pull images from different photo sharing services.

I am in the process of adding authentication support for this plugin and I have a question in this regard. I have built out the functionality to get a request token, authorize the application, then swap the request token for an access token. All of this works fine.

Now, the way I am building the plugin, if I have authenticated myself I would expect to have access to my password protected albums. So I build a request with these parameters:

     [oauth_version] => 1.0
     [oauth_nonce] => 8043328a9f549174faf3c95d2b5c58cc
     [oauth_timestamp] => 1332406973
     [oauth_consumer_key] => my-key
     [oauth_signature_method] => HMAC-SHA1
     [method] => smugmug.albums.get
     [oauth_token] => my-access-token
     [APIKey] => my-key
     [Empty] => false
     [Extras] => URL,ImageCount,Passworded,Password,NiceName
     [oauth_signature] => my-signature

As you can see, I have requested the additional URL, ImageCount, Passworded, Password and NiceName fields. As per the documentation (http://wiki.smugmug.net/display/API/show+1.3.0?method=smugmug.albums.get), NiceName and Password are available only to the owner.

When I execute the call, I get this:

            [id] => 19992722
            [Key] => 5NMJMR
            [Category] => stdClass Object
                (
                    [id] => 15
                    [Name] => Nature
                    [NiceName] => Nature
                    [URL] => http://sayontan.smugmug.com/Nature
                )
            [ImageCount] => 1
            [NiceName] => Sulphur-Mountain-Banff
            [Passworded] => 1
            [Title] => Sulphur Mountain, Banff
            [URL] => http://sayontan.smugmug.com/Nature/Sulphur-Mountain-Banff/19992722_5NMJMR

As you can see, the "Password" is omitted from the response. The "NiceName" is returned, so obviously the API understands that I am the owner. Try as I might I am unable to get the password to be returned.

Am I getting something wrong here?

MSkaffari

sayontan wrote: »

Hi,
I am the author of a plugin called Photonic for WordPress, which helps pull images from different photo sharing services.

I am in the process of adding authentication support for this plugin and I have a question in this regard. I have built out the functionality to get a request token, authorize the application, then swap the request token for an access token. All of this works fine.

Now, the way I am building the plugin, if I have authenticated myself I would expect to have access to my password protected albums. So I build a request with these parameters:

     [oauth_version] => 1.0
     [oauth_nonce] => 8043328a9f549174faf3c95d2b5c58cc
     [oauth_timestamp] => 1332406973
     [oauth_consumer_key] => my-key
     [oauth_signature_method] => HMAC-SHA1
     [method] => smugmug.albums.get
     [oauth_token] => my-access-token
     [APIKey] => my-key
     [Empty] => false
     [Extras] => URL,ImageCount,Passworded,Password,NiceName
     [oauth_signature] => my-signature

As you can see, I have requested the additional URL, ImageCount, Passworded, Password and NiceName fields. As per the documentation (http://wiki.smugmug.net/display/API/show+1.3.0?method=smugmug.albums.get), NiceName and Password are available only to the owner.

When I execute the call, I get this:

            [id] => 19992722
            [Key] => 5NMJMR
            [Category] => stdClass Object
                (
                    [id] => 15
                    [Name] => Nature
                    [NiceName] => Nature
                    [URL] => http://sayontan.smugmug.com/Nature
                )
            [ImageCount] => 1
            [NiceName] => Sulphur-Mountain-Banff
            [Passworded] => 1
            [Title] => Sulphur Mountain, Banff
            [URL] => http://sayontan.smugmug.com/Nature/Sulphur-Mountain-Banff/19992722_5NMJMR

As you can see, the "Password" is omitted from the response. The "NiceName" is returned, so obviously the API understands that I am the owner. Try as I might I am unable to get the password to be returned.

Am I getting something wrong here?

I'll pass this question to our developers, but I'm also wondering why do you need the password? If your app requests for full access the app shouldn't need a password to get data from password protected galleries.

devbobo

Hi,

I had a look at the OAuth token for your plugin that is attached to your SmugMug account and it only has Public access. In order to view the Password parameter you need Full access. To obtain Full access when you need to add to &Access=Full to authorize url that you redirect the user with. However, this only works when adding a new authorized app to a SmugMug account, for an existing account...the user needs to click the 'Change' link next to your app in their Authorized App List and change the value to 'Full'.

Cheers,

David

sayontan

devbobo wrote: »

However, this only works when adding a new authorized app to a SmugMug account, for an existing account...the user needs to click the 'Change' link next to your app in their Authorized App List and change the value to 'Full'.

Thanks, David! This solved the issue.