The simple LMS test application at http://www.imsglobal.org/devel.../LTI/test/v1p1/lms.php appears to not handle spaces in the oauth signature properly: It appears to turn the offered key's plus signs ('+') into spaces.

I have a tool that I'm testing with the above and stumbled upon this problem. Digging through what I can see on my side, it's reliably reproducible.



I'm using PHP's CURL to manage the request. Setting the option for CURLINFO_HEADER_OUT dumps what is being posted. I'm trying to determine if my code needs more work or not: I'm not too proud to say 'the problem could be on my end.'

The tool being tested is at http://www.classroom24-7.com/player/index2.php

Thanks in advance.

-------------------------
--

Does everything work when there is no space in the secret?

/Chuck

I just did a quick test where I switched the secret in my local copy of lms.php and
tool.php to "secret zzz" and it worked fine - both the launch and the callback for grade setting.

If I look in your output:

V1.0 4f4d48d941c9c failure status OAuth signature failed:
Invalid signature ours= K0y6d7q8h3tbm4+hWRNq2WbLrPA=
yours=K0y6d7q8h3tbm4 hWRNq2WbLrPA= B64key=123451
HDRkey=123451 secret=secret zzz

This comes from the tool_consumer_outcome.php and is showing what it is using as a
secret and correctly seems to be using "secret zzz"

I ran through the code, perhaps suspecting something wrong with the body hash - but the
signature check is done before the hash check and if the signature fail the hash is not
even computed so it is not the hash.

So that narrows this down to a base string check with the only real data in the base
string is the url parameters and the header values.

If you dump out the entire response, you will see in an HTML comment the base string
that the tool_consumer_outcome.php computed. Then print out your base string that
was used in your calling code to compute your signature and then compare them
character by character. Usually when we line up the two base strings - whatever is
wrong jumps out.

Thank you very much for this Dr Chuck.

-------------------------
--