DotNetOpenAuth.OAuth Represents the <oauth/consumer> element in the host's .config file. Gets the name of the security sub-element. Initializes a new instance of the class. Gets or sets the security settings. Security settings that are applicable to consumers. Initializes a new instance of the class. Initializes a programmatically manipulatable bag of these security settings with the settings from the config file. The newly created security settings object. Represents the <oauth> element in the host's .config file. The name of the oauth section. The name of the <consumer> sub-element. The name of the <serviceProvider> sub-element. Initializes a new instance of the class. Gets the configuration section from the .config file. Gets or sets the configuration specific for Consumers. Gets or sets the configuration specific for Service Providers. Represents the <oauth/serviceProvider> element in the host's .config file. The name of the custom store sub-element. Gets the name of the security sub-element. Initializes a new instance of the class. Gets or sets the type to use for storing application state. Gets or sets the security settings. Security settings that are applicable to service providers. Gets the name of the @minimumRequiredOAuthVersion attribute. Gets the name of the @maxAuthorizationTime attribute. Initializes a new instance of the class. Initializes a programmatically manipulatable bag of these security settings with the settings from the config file. The newly created security settings object. Gets or sets the minimum OAuth version a Consumer is required to support in order for this library to interoperate with it. Although the earliest versions of OAuth are supported, for security reasons it may be desirable to require the remote party to support a later version of OAuth. Gets or sets the maximum time a user can take to complete authorization. This time limit serves as a security mitigation against brute force attacks to compromise (unauthorized or authorized) request tokens. Longer time limits is more friendly to slow users or consumers, while shorter time limits provide better security. An interface that must be implemented by message transforms/validators in order to be included in the channel stack. Clones this instance. The cloned instance. Gets or sets the delegate that will initialize the non-serialized properties necessary on a signable message so that its signature can be correctly calculated or verified. Contract class for the interface. Prepares a message for sending based on the rules of this channel binding element. The message to prepare for sending. The protections (if any) that this binding element applied to the message. Null if this binding element did not even apply to this binding element. Implementations that provide message protection must honor the properties where applicable. Performs any transformation on an incoming message that may be necessary and/or validates an incoming message based on the rules of this channel binding element. The incoming message to process. The protections (if any) that this binding element applied to the message. Null if this binding element did not even apply to this binding element. Thrown when the binding element rules indicate that this message is invalid and should NOT be processed. Implementations that provide message protection must honor the properties where applicable. Clones this instance. The cloned instance. Gets or sets the delegate that will initialize the non-serialized properties necessary on a signable message so that its signature can be correctly calculated or verified. Gets or sets the channel that this binding element belongs to. This property is set by the channel when it is first constructed. Gets the protection commonly offered (if any) by this binding element. This value is used to assist in sorting binding elements in the channel stack. Utility methods specific to OAuth feature reporting. Records the feature and dependency use. The consumer or service provider. The service. The token manager. The nonce store. An interface OAuth hosts must implement for persistent storage and recall of tokens and secrets for an individual OAuth consumer or service provider. Gets the Token Secret given a request or access token. The request or access token. The secret associated with the given token. Thrown if the secret cannot be found for the given token. Stores a newly generated unauthorized request token, secret, and optional application-specific parameters for later recall. The request message that resulted in the generation of a new unauthorized request token. The response message that includes the unauthorized request token. Thrown if the consumer key is not registered, or a required parameter was not found in the parameters collection. Request tokens stored by this method SHOULD NOT associate any user account with this token. It usually opens up security holes in your application to do so. Instead, you associate a user account with access tokens (not request tokens) in the method. Deletes a request token and its associated secret and stores a new access token and secret. The Consumer that is exchanging its request token for an access token. The Consumer's request token that should be deleted/expired. The new access token that is being issued to the Consumer. The secret associated with the newly issued access token. Any scope of granted privileges associated with the request token from the original call to should be carried over to the new Access Token. To associate a user account with the new access token, HttpContext.Current.User may be useful in an ASP.NET web application within the implementation of this method. Alternatively you may store the access token here without associating with a user account, and wait until WebConsumer.ProcessUserAuthorization or DesktopConsumer.ProcessUserAuthorization return the access token to associate the access token with a user account at that point. Classifies a token as a request token or an access token. The token to classify. Request or Access token, or invalid if the token is not recognized. The code contract class for the interface. Prevents a default instance of the class from being created. Gets the Token Secret given a request or access token. The request or access token. The secret associated with the given token. Thrown if the secret cannot be found for the given token. Stores a newly generated unauthorized request token, secret, and optional application-specific parameters for later recall. The request message that resulted in the generation of a new unauthorized request token. The response message that includes the unauthorized request token. Thrown if the consumer key is not registered, or a required parameter was not found in the parameters collection. Request tokens stored by this method SHOULD NOT associate any user account with this token. It usually opens up security holes in your application to do so. Instead, you associate a user account with access tokens (not request tokens) in the method. Deletes a request token and its associated secret and stores a new access token and secret. The Consumer that is exchanging its request token for an access token. The Consumer's request token that should be deleted/expired. The new access token that is being issued to the Consumer. The secret associated with the newly issued access token. Any scope of granted privileges associated with the request token from the original call to should be carried over to the new Access Token. To associate a user account with the new access token, HttpContext.Current.User may be useful in an ASP.NET web application within the implementation of this method. Alternatively you may store the access token here without associating with a user account, and wait until WebConsumer.ProcessUserAuthorization or DesktopConsumer.ProcessUserAuthorization return the access token to associate the access token with a user account at that point. Classifies a token as a request token or an access token. The token to classify. Request or Access token, or invalid if the token is not recognized. Sets the HTTP Method property on a signed message before the signing module gets to it. Prepares a message for sending based on the rules of this channel binding element. The message to prepare for sending. True if the applied to this binding element and the operation was successful. False otherwise. Performs any transformation on an incoming message that may be necessary and/or validates an incoming message based on the rules of this channel binding element. The incoming message to process. True if the applied to this binding element and the operation was successful. False if the operation did not apply to this message. Thrown when the binding element rules indicate that this message is invalid and should NOT be processed. Gets the protection offered (if any) by this binding element. Gets or sets the channel that this binding element belongs to. A binding element that signs outgoing messages and verifies the signature on incoming messages. A binding element that signs outgoing messages and verifies the signature on incoming messages. The signature method this binding element uses. Initializes a new instance of the class. The OAuth signature method that the binding element uses. Creates a new object that is a copy of the current instance. A new object that is a copy of this instance. Signs the outgoing message. The message to sign. The protections (if any) that this binding element applied to the message. Null if this binding element did not even apply to this binding element. Verifies the signature on an incoming message. The message whose signature should be verified. The protections (if any) that this binding element applied to the message. Null if this binding element did not even apply to this binding element. Thrown if the signature is invalid. Constructs the OAuth Signature Base String and returns the result. The message. The message to derive the signature base string from. The signature base string. This method implements OAuth 1.0 section 9.1. Calculates a signature for a given message. The message to sign. The signature for the message. This method signs the message per OAuth 1.0 section 9.2. Gets the "ConsumerSecret&TokenSecret" string, allowing either property to be empty or null. The message to extract the secrets from. The concatenated string. Determines whether the signature on some message is valid. The message to check the signature on. true if the signature on the message is valid; otherwise, false. Clones this instance. A new instance of the binding element. Implementations of this method need not clone the SignatureVerificationCallback member, as the class does this. Calculates a signature for a given message. The message to sign. The signature for the message. Checks whether this binding element applies to this message. The message that needs to be signed. True if this binding element can be used to sign the message. False otherwise. Sorts parameters according to OAuth signature base string rules. The first parameter to compare. The second parameter to compare. Negative, zero or positive. Gets the message protection provided by this binding element. Gets or sets the channel that this binding element belongs to. Gets or sets the delegate that will initialize the non-serialized properties necessary on a signed message so that its signature can be correctly calculated for verification. Initializes a new instance of the class. Calculates a signature for a given message. The message to sign. The signature for the message. This method signs the message according to OAuth 1.0 section 9.4.1. Checks whether this binding element applies to this message. The message that needs to be signed. True if this binding element can be used to sign the message. False otherwise. Clones this instance. A new instance of the binding element. A binding element that signs outgoing messages and verifies the signature on incoming messages. Initializes a new instance of the class Calculates a signature for a given message. The message to sign. The signature for the message. This method signs the message per OAuth 1.0 section 9.2. Clones this instance. A new instance of the binding element. Code Contract for the class. Prevents a default instance of the SigningBindingElementBaseContract class from being created. Clones this instance. A new instance of the binding element. Implementations of this method need not clone the SignatureVerificationCallback member, as the class does this. Calculates a signature for a given message. The message to sign. The signature for the message. A tamper protection applying binding element that can use any of several given binding elements to apply the protection. The various signing binding elements that may be applicable to a message in preferred use order. Initializes a new instance of the class. The signing binding elements that may be used for some outgoing message, in preferred use order. Prepares a message for sending based on the rules of this channel binding element. The message to prepare for sending. The protections (if any) that this binding element applied to the message. Null if this binding element did not even apply to this binding element. Performs any transformation on an incoming message that may be necessary and/or validates an incoming message based on the rules of this channel binding element. The incoming message to process. The protections (if any) that this binding element applied to the message. Null if this binding element did not even apply to this binding element. Creates a new object that is a copy of the current instance. A new object that is a copy of this instance. Gets or sets the delegate that will initialize the non-serialized properties necessary on a signed message so that its signature can be correctly calculated for verification. May be null for Consumers (who never have to verify signatures). Gets the protection offered (if any) by this binding element. Gets or sets the channel that this binding element belongs to. The two types of tokens that exist in the OAuth protocol. A token that is freely issued to any known Consumer. It does not grant any authorization to access protected resources, but is used as a step in obtaining that access. A token only obtained after the owner of some protected resource(s) has approved a Consumer's access to said resource(s). An unrecognized, expired or invalid token. An URI encoder that translates null references as "oob" instead of an empty/missing argument. The string constant "oob", used to indicate an out-of-band configuration. Initializes a new instance of the class. Encodes the specified value. The value. Guaranteed to never be null. The in string form, ready for message transport. Decodes the specified value. The string value carried by the transport. Guaranteed to never be null, although it may be empty. The deserialized form of the given string. Thrown when the string value given cannot be decoded into the required object type. Gets the string representation to include in a serialized message when the message part has a null value. Security settings that are applicable to consumers. Security settings that may be applicable to both consumers and service providers. Initializes a new instance of the class. Initializes a new instance of the class. An interface implemented by all OAuth messages that have a request or access token and secret properties. An interface implemented by all OAuth messages that have a request or access token property. Gets or sets the Request or Access Token. Gets or sets the Request or Access Token secret. A strongly-typed resource class, for looking up localized strings, etc. Returns the cached ResourceManager instance used by this class. Overrides the current thread's CurrentUICulture property for all resource lookups using this strongly typed resource class. Looks up a localized string similar to Cannot send access token to Consumer for request token '{0}' before it has been authorized.. Looks up a localized string similar to The access token '{0}' is invalid or expired.. Looks up a localized string similar to Failure looking up secret for consumer or token.. Looks up a localized string similar to oauth_verifier argument was incorrect.. Looks up a localized string similar to An invalid OAuth message received and discarded.. Looks up a localized string similar to The {0} message included extra data which is not allowed.. Looks up a localized string similar to This OAuth service provider requires OAuth consumers to implement OAuth {0}, but this consumer appears to only support {1}.. Looks up a localized string similar to Cannot send OAuth message as multipart POST without an authorization HTTP header because sensitive data would not be signed.. Looks up a localized string similar to Use of the OpenID+OAuth extension requires that the token manager in use implement the {0} interface.. Looks up a localized string similar to The OpenID Relying Party's realm is not recognized as belonging to the OAuth Consumer identified by the consumer key given.. Looks up a localized string similar to The request URL query MUST NOT contain any OAuth Protocol Parameters.. Looks up a localized string similar to The signing element already has been associated with a channel.. Looks up a localized string similar to All signing elements must offer the same message protection.. Looks up a localized string similar to A token in the message was not recognized by the service provider.. Looks up a localized string similar to The RSA-SHA1 signing binding element has not been set with a certificate for signing.. A description of the endpoints on a Service Provider. The field used to store the value of the property. Initializes a new instance of the class. Creates a signing element that includes all the signing elements this service provider supports. The created signing element. Gets or sets the OAuth version supported by the Service Provider. Gets or sets the URL used to obtain an unauthorized Request Token, described in Section 6.1 (Obtaining an Unauthorized Request Token). The request URL query MUST NOT contain any OAuth Protocol Parameters. This is the URL that messages are directed to. Thrown if this property is set to a URI with OAuth protocol parameters. Gets or sets the URL used to obtain User authorization for Consumer access, described in Section 6.2 (Obtaining User Authorization). This is the URL that messages are indirectly (via the user agent) sent to. Gets or sets the URL used to exchange the User-authorized Request Token for an Access Token, described in Section 6.3 (Obtaining an Access Token). This is the URL that messages are directed to. Gets or sets the signing policies that apply to this Service Provider. Gets the OAuth version supported by the Service Provider. A base class for all signed OAuth messages. A base class for all OAuth messages. A store for extra name/value data pairs that are attached to this message. Gets a value indicating whether signing this message is required. Gets a value indicating whether this is a direct or indirect message. The URI to the remote endpoint to send this message to. Backing store for the properties. Backing store for the properties. Initializes a new instance of the class for direct response messages. The level of protection the message requires. The request that asked for this direct response. The OAuth version. Initializes a new instance of the class for direct requests or indirect messages. The level of protection the message requires. A value indicating whether this message requires a direct or indirect transport. The URI that a directed message will be delivered to. The OAuth version. Checks the message state for conformity to the protocol specification and throws an exception if the message is invalid. Returns a human-friendly string describing the message and all serializable properties. The channel that will carry this message. The string representation of this object. Sets a flag indicating that this message is received (as opposed to sent). Checks the message state for conformity to the protocol specification and throws an exception if the message is invalid. Gets the version of the protocol this message is prepared to implement. Gets the level of protection this message requires. Gets a value indicating whether this is a direct or indirect message. Gets the dictionary of additional name/value fields tacked on to this message. Gets the URI to the Service Provider endpoint to send this message to. Gets the preferred method of transport for the message. Gets the originating request message that caused this response to be formed. Gets or sets a value indicating whether security sensitive strings are emitted from the ToString() method. Gets a value indicating whether this message was deserialized as an incoming message. Gets the version of the protocol this message is prepared to implement. Gets the level of protection this message requires. Gets a value indicating whether this is a direct or indirect message. Gets the dictionary of additional name/value fields tacked on to this message. Gets the preferred method of transport for the message. Gets or sets the URI to the Service Provider endpoint to send this message to. Gets the originating request message that caused this response to be formed. An interface that OAuth messages implement to support signing. Gets or sets the method used to sign the message. Gets or sets the Token Secret used to sign the message. Gets or sets the Consumer key. Gets or sets the Consumer Secret used to sign the message. Gets or sets the HTTP method that will be used to transmit the message. Gets or sets the URL of the intended receiver of this message. The reference date and time for calculating time stamps. The number of seconds since 1/1/1970, consistent with the OAuth timestamp requirement. Initializes a new instance of the class. A value indicating whether this message requires a direct or indirect transport. The URI that a directed message will be delivered to. The OAuth version. Gets or sets the signature method used to sign the request. Gets or sets the Token Secret used to sign the message. Gets or sets the Consumer key. Gets or sets the Consumer Secret used to sign the message. Gets or sets the HTTP method that will be used to transmit the message. Gets or sets the URI to the Service Provider endpoint to send this message to. Gets or sets the message signature. Gets or sets the OAuth timestamp of the message. Gets the context within which the nonce must be unique. The consumer key. Gets or sets the message nonce used for replay detection. Gets or sets the original message parts, before any normalization or default values were assigned. Gets or sets the original message parts, before any normalization or default values were assigned. Gets or sets the signature method used to sign the request. Gets or sets the Token Secret used to sign the message. Gets or sets the Consumer Secret used to sign the message. Gets or sets the HTTP method that will be used to transmit the message. Gets or sets the message signature. Gets or sets the version of the protocol this message was created with. Security settings that are applicable to service providers. Initializes a new instance of the class. Gets or sets the minimum required version of OAuth that must be implemented by a Consumer. Gets or sets the maximum time a user can take to complete authorization. This time limit serves as a security mitigation against brute force attacks to compromise (unauthorized or authorized) request tokens. Longer time limits is more friendly to slow users or consumers, while shorter time limits provide better security. A direct message sent by the Consumer to exchange an authorized Request Token for an Access Token and Token Secret. The class is sealed because the OAuth spec forbids adding parameters to this message. Initializes a new instance of the class. The URI of the Service Provider endpoint to send this message to. The OAuth version. Checks the message state for conformity to the protocol specification and throws an exception if the message is invalid. Gets or sets the Token. Gets or sets the verification code received by the Consumer from the Service Provider in the property. Gets or sets the authorized Request Token used to obtain authorization. A message attached to a request for protected resources that provides the necessary credentials to be granted access to those resources. A store for the binary data that is carried in the message. Initializes a new instance of the class. The URI of the Service Provider endpoint to send this message to. The OAuth version. Gets or sets the Token. Gets or sets the Access Token. In addition to just allowing OAuth to verify a valid message, this property is useful on the Service Provider to verify that the access token has proper authorization for the resource being requested, and to know the context around which user provided the authorization. Gets the parts of the message that carry binary data. A list of parts. Never null. Gets a value indicating whether this message should be sent as multi-part POST. A direct message sent from Service Provider to Consumer in response to a Consumer's request. Initializes a new instance of the class. The originating request. Gets or sets the Access Token assigned by the Service Provider. Gets or sets the Request or Access Token. Gets or sets the Request or Access Token secret. Gets the extra, non-OAuth parameters that will be included in the message. Gets or sets the Token Secret. A message used to redirect the user from a Service Provider to a Consumer's web site. The class is sealed because extra parameters are determined by the callback URI provided by the Consumer. Initializes a new instance of the class. The URI of the Consumer endpoint to send this message to. The OAuth version. Gets or sets the Request or Access Token. Gets or sets the verification code that must accompany the request to exchange the authorized request token for an access token. An unguessable value passed to the Consumer via the User and REQUIRED to complete the process. If the Consumer did not provide a callback URL, the Service Provider SHOULD display the value of the verification code, and instruct the User to manually inform the Consumer that authorization is completed. If the Service Provider knows a Consumer to be running on a mobile device or set-top box, the Service Provider SHOULD ensure that the verifier value is suitable for manual entry. Gets or sets the Request Token. A message used to redirect the user from a Consumer to a Service Provider's web site so the Service Provider can ask the user to authorize the Consumer's access to some protected resource(s). Initializes a new instance of the class. The URI of the Service Provider endpoint to send this message to. The request token. The OAuth version. Initializes a new instance of the class. The URI of the Service Provider endpoint to send this message to. The OAuth version. Gets or sets the Request or Access Token. Gets the extra, non-OAuth parameters that will be included in the message. Gets a value indicating whether this is a safe OAuth authorization request. true if the Consumer is using OAuth 1.0a or later; otherwise, false. Gets or sets the Request Token obtained in the previous step. The Service Provider MAY declare this parameter as REQUIRED, or accept requests to the User Authorization URL without it, in which case it will prompt the User to enter it manually. Gets or sets a URL the Service Provider will use to redirect the User back to the Consumer when Obtaining User Authorization is complete. Optional. A direct message sent from Service Provider to Consumer in response to a Consumer's request. Initializes a new instance of the class. The unauthorized request token message that this message is being generated in response to. The request token. The token secret. This constructor is used by the Service Provider to send the message. Initializes a new instance of the class. The originating request. The OAuth version. This constructor is used by the consumer to deserialize the message. Gets or sets the Request or Access Token. Gets or sets the Request or Access Token secret. Gets the extra, non-OAuth parameters that will be included in the message. Gets or sets the Request Token. Gets the original request for an unauthorized token. Gets or sets the Token Secret. Gets a value indicating whether the Service Provider recognized the callback parameter in the request. An OAuth-specific implementation of the class. Initializes a new instance of the class. The binding element to use for signing. The ITokenManager instance to use. The security settings. An injected message type provider instance. Except for mock testing, this should always be one of OAuthConsumerMessageFactory or OAuthServiceProviderMessageFactory. The binding elements. Uri-escapes the names and values in a dictionary per OAuth 1.0 section 5.1. The message with data to encode. A dictionary of name-value pairs with their strings encoded. Initializes a web request for sending by attaching a message to it. Use this method to prepare a protected resource request that you do NOT expect an OAuth message response to. The message to attach. The initialized web request. Initializes the binding elements for the OAuth channel. The signing binding element. The nonce store. An array of binding elements used to initialize the channel. Searches an incoming HTTP request for data that could be used to assemble a protocol request message. The HTTP request to search. The deserialized message, if one is found. Null otherwise. Gets the protocol message that may be in the given HTTP response. The response that is anticipated to contain an protocol message. The deserialized message parts, if found. Null otherwise. Prepares an HTTP request that carries a given message. The message to send. The prepared to send the request. Queues a message for sending in the response stream where the fields are sent in the response stream in querystring style. The message to send as a response. The pending user agent redirect based message to be sent as an HttpResponse. This method implements spec V1.0 section 5.3. Gets the consumer secret for a given consumer key. The consumer key. A consumer secret. Uri-escapes the names and values in a dictionary per OAuth 1.0 section 5.1. The dictionary with names and values to encode. The dictionary to add the encoded pairs to. Gets the HTTP method to use for a message. The message. "POST", "GET" or some other similar http verb. Prepares to send a request to the Service Provider via the Authorization header. The message to be transmitted to the ServiceProvider. The web request ready to send. If the message has non-empty ExtraData in it, the request stream is sent to the server automatically. If it is empty, the request stream must be sent by the caller. This method implements OAuth 1.0 section 5.2, item #1 (described in section 5.4). Fills out the secrets in a message so that signing/verification can be performed. The message about to be signed or whose signature is about to be verified. Gets or sets the Consumer web application path. Gets the token manager being used. A direct message sent from Consumer to Service Provider to request a Request Token. Initializes a new instance of the class. The URI of the Service Provider endpoint to send this message to. The OAuth version. Gets or sets the absolute URL to which the Service Provider will redirect the User back when the Obtaining User Authorization step is completed. The callback URL; or null if the Consumer is unable to receive callbacks or a callback URL has been established via other means. Gets the extra, non-OAuth parameters that will be included in the message. A binding element that signs outgoing messages and verifies the signature on incoming messages. The name of the hash algorithm to use. Initializes a new instance of the class. An enumeration of the OAuth protocol versions supported by this library. OAuth 1.0 specification OAuth 1.0a specification Constants used in the OAuth protocol. OAuth Protocol Parameter names and values are case sensitive. Each OAuth Protocol Parameters MUST NOT appear more than once per request, and are REQUIRED unless otherwise noted, per OAuth 1.0 section 5. The namespace to use for V1.0 of the protocol. The prefix used for all key names in the protocol. The string representation of a instance to be used to represent OAuth 1.0a. The scheme to use in Authorization header message requests. Gets the instance with values initialized for V1.0 of the protocol. Gets the instance with values initialized for V1.0a of the protocol. A list of all supported OAuth versions, in order starting from newest version. The default (or most recent) supported version of the OAuth protocol. The namespace to use for this version of the protocol. Initializes a new instance of the class. Gets the OAuth Protocol instance to use for the given version. The OAuth version to get. A matching instance. Gets the OAuth Protocol instance to use for the given version. The OAuth version to get. A matching instance. Gets the OAuth version this instance represents. Gets the version to declare on the wire. Gets the enum value for the instance. Gets the namespace to use for this version of the protocol.