Mastodon

Mastodon is a federated micro-blogging service. “Federated” means that there are many servers, each with their own rules, unlike Facebook, Google+ or Twitter. “Micro-blogging” means that you can post status updates up to 500 characters long.

I wrote mastodon-backup so that people can download their own toots, favorites and media attachments.

I also wrote bitlbee-mastodon. This plugin allows Bitblee to communicate with Mastodon instances. Bitlbee is an IRC server connecting to various other text messaging services. You run Bitlbee and connect to it using an IRC client, then configure Bitblee to connect to other services, such as a Mastodon instance where you already have an account. The benefit is that you can now use any IRC client you want to connect to Mastodon.

If you’re new, I recommend this post: How to Mastodon.

2019-03-17 Mastodon Bots

I have written a small number of bots for Mastodon in Python but only today did I learn that somebody has written an entire framework for Python based bot writing. „Ananas allows you to write simple (or complicated!) mastodon bots without having to rewrite config file loading, interval-based posting, scheduled posting, auto-replying, and so on.“ #Mastodon #Bot

Tags:

Add Comment

2019-03-10 Das Ende der föderierten Dienste steht nicht an

Schon seit einer Weile geistert der Artikel von Alyssa Rosenzweig (@alyssa) in meinem Umfeld herum. In The Federation Fallacy argumentiert sie, dass föderierten Dienste ein Traum sind und bleiben. Früher oder später werden daraus zentralisierte Dienste. Im Kern sind die Dienste zwar immer noch föderiert, aber praktisch sind sie zentralisiert. E-Mail ist fast immer Google; Chat (XMPP) ist fast immer Facebook, wegen WhatsApp und dem Facebook Messenger; und selbst das Web besteht praktisch nur aus den wirklich grossen Webseiten. Und vor allem: selbst neue Entwicklungen wie Mastodon, welche sie die Föderation auf die Fahne geschrieben haben, stehen nicht besser da, denn mehr als 50% aller Benutzer befinden sich auf nur drei Instanzen.

Erste Reaktionen waren mir hierzu schon aufgefallen.

Chris (@brainblasted) schrieb hierzu:

As a black person who tries to push privacy, I push federation not for self-hosting, but for community-based hosting. It’s a given that not everyone has the time or resources to put into hosting their own services. Federation empowers users to be able to trust their administrators or be them. This is invaluable for marginalized groups.

As a black person, it’s a fact there are people who will attack me because of my blackness or because I speak to the issues black people face. On some centralized platforms, there wouldn’t be recourse. I would have to hit report, wait for something to get through the moderation queue, and hope the user is banned. In a lot of cases, harassers are left on the platform.

With people like @Are0h hosting communities for black people, all you have to do is DM your admin or a mod and they can prevent that user from harassing anyone else on the server.

Federation is not a “fuck you, got mine” system. It’s a system we can use in order to protect each other.

Hier haben wir also einen klaren Vorteil für Minderheiten. Die Föderation von Mastodon erlaubt es Minderheiten, sich Administratoren zu wählen, welche ihre Interessen vertreten. Dass Minderheiten in der Minderheit liegen, ist Natur der Sache. Deswegen interessiert aus seiner Perspektive natürlich nicht, wie erfolgreich und wie gross die Mehrheit ist.

Sajith (@sajith) schreibt aus einer ähnlichen Perspektive:

“what’s the real conclusion? We should just give up trying? … I run an instance for friends that speak my native language. … I am having fun hanging out here, and so do you all, I would I would like to believe. By that measure Mastodon is a success.”

Neu ist nun aber folgende Frage: Wie messen wir den Erfolg? Wenn es ihm Spass macht, dann ist es doch ein Erfolg? Und sowieso: Sollen wir alle Versuche, den Kapitalismus zu überwinden, aufgeben, nur weil der Kapitalismus bis jetzt alles und jeden vereinnahmt hat? Natürlich nicht.

So ähnlich geht es mir auch.

Ich habe das Server E-Mail Hosting aufgegeben, weil ich fand, dass es mühsam war, mit all den Anti-Spam Massnahmen von Google Schritt zu halten (aber auch mit dem Anti-Spam Massnahmen ganz allgemein). Also ein Punkt für die Zentralisation. Aber ich habe auch ein Konto bei gnu.org (wird auf Google umgeleitet) und bei protonmail.com (wird nur selten verwendet). Also doch ein Punkt für die Föderation?

Einen XMPP Server hatte ich mal installiert, aber irgendwie habe ich es nicht geschafft, die Verbindung zu verschlüsseln, und viel Energie wollte ich nicht investieren, deswegen bin ich im Moment ab und zu über Pluspora <kensanata@pluspora.com> und die FSFE <as@fsfe.org> per XMPP zur erreichen. Wird zwar fast nicht verwendet, aber es existiert. Und nota bene war es nicht nötig, mit den Betreibern verwandt oder befreundet zu sein.

Den eigenen Webserver betreibe ich ja (mit mehreren Webseiten) – und eigentlich betreibe ich ja auch Webseiten für Claudia und meinen ehemaligen Arabischlehrer… Weitere Punkte für die Föderation!

Und meine Mastodon Konten habe ich auf tabletop.social (2308 Benutzer, gemäss der List der Mastodon Instanzen) und octodon.social (11831 Benutzer), also nicht auf den populärsten Instanzen. Noch mehr Punkte für die Föderation.

Grundsätzlich stimmen Alyssa Rosenzweigs Überlegungen natürlich schon, wenn ich von meiner eigenen Situation weg schaue.

Each service retains the theoretical ability to federate with tiny self-hosted servers, but the vast majority of users are de facto concentrated about a few major servers.

Stimmt. Aber was ist die Messlatte, das Ziel? Die freie Wahl? Die Zerstörung der faktischen Monopole? Das Ende vom Kapitalismus? Aber diese Fragen stellt Alyssa Rosenzweig ja auch.

Ihre Schlussfolgerungen teile ich allerdings nicht. “Federation is dead.” Naja, das Ende des Kapitalismus, falls das denn unser Ziel wäre, braucht ja viele Massnahmen. In diesem Zusammenhang sehe ich vor allem diese hier:

  • die Existenz von Alternativen (haben wir jetzt)
  • das Verbot von Monopolen (siehe dazu die Reihe zum Thema Antitrust von Planet Money [1] [2] [3], wo es darum geht, dass mit der Wahl Reagan und den Argumenten von Burke der Sinn von Antitrust weg vom Schutz der Konkurrenz hin zum Schutz der Konsumenten und tiefen Preisen geändert hat, und dass diese Sichtweise im Zeitalter der Digitalisierung, wo wir mit Privatsphärenverlust statt mit Geld zahlen, vielleicht nicht mehr angebracht ist)
  • die Erbringung der Dienstleistungen ausserhalb vom Überwachungskapitalismus (Werbung), oder der grossen Internetdienstleister (Bezahlung), sondern auf Basis von nicht-kommerziellen Vereinen oder Stiftungen, oder durch Verstaatlichungen (das mit den Spenden scheint im Moment so halbwegs zu funktionieren)

So lange wir also nicht bereit sind Google, Facebook oder Amazon zu zerschlagen, so lange Gmail, WhatsApp und Instagram vom Überwachungskapitalismus alimentiert werden können, so lange bleibt das Ziel unerreichbar. Daraus nun aber zu schliessen, dass Föderation eine Sackgasse ist… Nein, diese Schlussfolgerung teile ich nicht.

Tags:

Add Comment

2019-02-14 Trunk Wiki?

I’m starting to feel that maybe I could simply replace the Trunk web app with a wiki. The only drawback is that people could add others without their consent. I wonder how we would handle that… perhaps the accounts added would get mentioned in a direct message and they would only show up on the page after confirming with a reply from their account? Trunk admins could simply keep an eye on the wiki’s recent changes page or something. Anyway, just thinking aloud.

Tags:

Add Comment

2019-02-05 Using Social Media

Here’s how I use social media in order for it to work out. My premise is that it is impossible to bring your friends and family along to a new platform. You need to find new friends. The only way to do it is to find people you share an interest with, and letting them know that you share their interest. The second step is important!

Make sure you have a profile that tells people what to expect.

  1. Pick a display name.
  2. Write a short bio using hashtags.
  3. Upload a profile picture (”Avatar”).

Hashtags are important so that similar minded people can find each other.

Write an introduction. Write a post and use the hashtag #introduction on Mastodon or #newhere on Diaspora. Say who you are and what you’re interested in, and use more hashtags.

Post this introduction and pin it to your profile, if you can. Your introduction will now be the first thing people see when they visit your profile. After a while you are of course free to pin a different post to your profile. I recommend you start with your introduction, however.

Write another handful of posts. When people visit your profile, they need to see that you are interested in the things they are interested in. Your introduction is a start, but it is not enough.

Don’t just share some stuff other people have written. If the things you shared are interesting, visitors will follow the authors of the posts you shared instead of you. You need to write your own posts!

Start interacting. You can mark something as a favourite (heart, star); you can find posts you like using searches for hashtags, or by looking through timelines, and reply to these posts; and if you really like something, you can share it (reshare, boost).

  • Marking something as a favourite does not start a conversation. People will smile and nod and read something else.
  • A reply is best in life. This is how you get a conversation started.
  • A reshare or boost is nice for artists and creators, but know that people will follow you if they can get a sense of the real you, and that requires posting your own toots.
  • Follow people.

How do you find more interesting people to follow? Look to see who your favourite folks are following. You can find them via the profiles of the people you are following.

Keep following people: You need to keep finding more people to follow in an interest based network since people will be dropping out all the time. Your relatives and friends from school don’t disappear as quickly on Facebook, nor do journalists and news outlets disappear on Twitter, but in the more interesting and interest-based communities, that’s simply how it is. You need to replenish the pool and keep finding and following more people. They’re everywhere.

For more information, check out How to Mastodon.

Tags:

Add Comment

2018-12-21 Blogs on the fediverse

Does it make sense to have a blog on the fediverse?

My blog on the fediverse (not self hosted: @darius wrote RSS to ActivityPub Converter and hosts it on his bots subdomain):

I was talking to @ckeen and @carbontwelve about it.

I guess I could try and get the mentions of the blog post and cross-post them to the blog – which might work if people knew about it.

I had something set up that basically queried the instance for the toot context and included it, but for my regular account I felt this didn’t match the expectations of people commenting. But for a bot account it might work.

Now that I’ve seen the first toot, I’m not sure what to make of it. The formatting is still a bit wonky. I would have liked the image to be used for the bot.

Actually, the current RSS to ActivityPub Converter is very simple: it doesn’t provide a complete web interface which is why the the link to the profile works, but you can’t actually follow the links to the individual posts. And if you can’t visit the post then you can’t “link” from your blog post to the fediverse post. It’s not accessible via the web. (that makes sense because the original is available via the web).

My first thought was that now if you want to transclude all the replies to the post, you basically have to link to a copy of the post on a different instance, and thus you don’t get to see the entire context. Which perhaps is good because if you pick the instance where you main account is, then at least all the default blocks are in place.

So, in this case, it would be this toot on octodon.social, but now that I’m testing it from a private browsing window, it redirects me to the originating URL, which is on Darius’ server which doesn’t work. Perhaps if Darius then redirected that request to the original blog post, the UI problem would disappear, but we could still not use transclusion to get all the replies.

Oh well. I’m talking to Darius on Mastodon. This is a cool project. :)

Tags:

Add Comment

2018-12-20 Greeter Bot

Greeter is another little Bot I wrote for Mastodon, in Python. This one greets new people on an instance.

More in the README file.

Tags:

Add Comment

2018-10-25 Using a Mastodon Bot

Perhaps if I had a dedicated bot acting on behalf of the blog, like a newsbot. It toots what I post on the blog, and it posts any replies it gets as comments to the blog. Hm. 🤔

I’ll have to think about that. 🧠

I had half of a Blog/Mastodon bridge going for a while until I decided that people on Mastodon weren’t expecting their toots to show up as comments on the blog (including caching and all that), specially as I myself am trying to expire all my old toots. But a dedicated bot would (perhaps?) solve that problem.

Tags:

Comments on 2018-10-25 Using a Mastodon Bot

That should be relatively easy. I have a few Twitter bots that crawl RSS feeds and post them to Twitter, it’d just be a matter of changing the output API to Mastodon.

Neither costs me anything at the moment.

Wes Baker 2018-10-25 17:08 UTC


Very cool, thanks for the links!

– Alex Schroeder 2018-10-25 20:13 UTC

Add Comment

2018-10-21 RPG Mastodon

I need to keep track of Mastodon and Pleroma instances related to role-playing games...

Tags:

Add Comment

2018-10-17 Trunk Quality Program

I fear that a lot of the people that volunteered for Trunk have either fallen silent (a common problem), or they don’t actually toot a lot on the topics they signed up for. Perhaps they’re interested in following more people tooting about the topic and were confused about the purpose of the lists, or they do write about the topics but they also write about a gazillion other things, drowning out the signal people might be looking for, or it turns out that they mostly boost other people instead of writing their own toots (in which case we might be interested in adding the people they’re boosting to our lists instead).

It’s difficult! I’m considering going through all the lists (ugh!) and clicking on all the linked people. Removing people from Trunk feels like acting as the content police. It’s awful. I need to get into the mindset of “curating.” Perhaps I wouldn’t feel so bad if I were a curator at a gallery, picking and choosing the people that get exposure. But who am I kidding. I’d still feel bad.

But I want better quality for Trunk! So I need to get into the groove. I need to repeat this, like a mantra:

  • If people are no longer active, I’m going to remove them.
  • If people are mostly boosting others, I’m going to remove them.
  • If people are mostly writing about other stuff, I’m going to remove them.

Should I notify them? I wonder. Are they going to change? I hope not! But perhaps it would still be fair to tell them. Hm. 🤔

Like this, perhaps:

Hi! I’m slowly going through the lists on Trunk to see whether people actually write about the topics they volunteered for. I followed a link to your profile and didn’t see a lot of posts on the topics you were listed under so I’m going to remove you from the lists. I hope you understand. 🙇 If you’re simply interested in reading about a topic, you don’t need to be on the list, you can simply follow people on the list. 🐘

Tags:

Comments on 2018-10-17 Trunk Quality Program

Yeah, I think that the slight reminder makes a lot of sense. I don’t remember what I supposed to do after joining some lists to be honest.

Jacky 2018-10-17 07:15 UTC


“The road to hell is paved with good intentions.”

People probably intend to post on their chosen topics, but never get around to it. I’m sure people will accept that failing, if it is pointed out to them. It probably doesn’t require individual communication, blanket statement somewhere would be fine.

Fitheach 2018-10-17 08:34 UTC


I liked the comment by @ckeen: “Trunk’s biggest plus is somewhat showing the broadness of possible stuff people talk about. With the usual introductions you will find yourself sitting in a very small bubble. […] So I think trunk is useful as such, I am wondering how much active curating is necessary to achieve good connections.”

Indeed. How much active curating is necessary? I’ll have to think about this some more.

– Alex Schroeder 2018-10-18 20:09 UTC


Perhaps a simple first step is to remove inactive accounts? I’m also interested in removing shit posters (is there a better word?) – just the most obvious off-topic posters, if we have any of them. I also don’t know how to get started. As an individual admin perhaps by simply picking a list, clicking on all the accounts, removing the ones that I think need to go, and then send a message to the admins. The admins can check the log and provide feedback if they want. Something low-level like that?

– Alex Schroeder 2019-02-28 22:29 UTC

Add Comment

2018-09-12 OAuth and Mastodon

This page is mostly about trying to debug OAuth for Mastodon. Here’s the thing: I have a web application called Trunk. When you use it, you can mass-follow a number of accounts.

Sadly, I see OAuth issues piling up. I get the impression that my app mostly works, but every day I see reports by users getting “Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method”. The 3 instances I looked at reported their version to be 2.5.0 according to /api/v1/instances. What do you think I should do? How to debug this?

This is why I started writing this page. I’m hoping that some Mastodon client developer can look at the flow of things and tell me where I’m doing it wrong. Or perhaps they are running into similar issues and found a way around it? Perhaps register the app every single time? Who knows. All I know is that I’m seeing multiple reports.

If you want to look at the source code while you read this, you can find it in my repository.

The basic overview of the OAuth flow is this:

  1. Create your app in the instance and make sure you use the same scopes and redirect URL later. This gives you the client credentials client_id and client_secret.
  2. Redirect your user to the instance using the same scopes, redirect URL, and client credentials.
  3. If all went well, you’ll your redirection URL gets visited with a code parameter. Transform it into an access token ASAP (using the same parameters as before).
  4. Use the token as bearer token for each call to the mastodon API.

Here’s what this looks like in my app.

You start out with /follow_confirm. The web site says:

Please confirm
We’re going to use kensanata@octodon.social to follow all the accounts in Test.
Let’s do this
If you’d like to help us find the authorisation problems we’ve been having, please use the following link instead:
Let’s log this

When you click the link, you’re sent to the /auth route. There, we’re going to get ourselves a client. We check if the client is already registered. We do this by checking our file with all the client credentials and look for the octodon.social credentials. If we don’t find them, we’re going to register the client. in this case this is not necessary.

The /auth route now has a client. We’re going to authorise it. This means storing a bunch of cookies in the browser and then redirecting to the oauth URL of octodon.social. If the browser has the octodon.social cookie set, then no action is required. Otherwise, I need to click the big Authorize button. octodon.social then redirects back to our application, i.e. the / route, with an authorisation code.

I think this is where people are getting the error: “Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method”. They get the error from the instance, not from my web application, after all.

Screenshot of the error message

Anyway, assuming everything worked as intended... We’re back at / and we need to figure out what to do. If we are being called without a code, then we’re just going to show our main page. But in this case, we did get a code. So now we look at our cookies in order to discover what it was I was trying to accomplish. Ah! I was trying to follow the Test list, right. So we’re going to redirect to /do/follow.

The /do/follow route looks at the cookie and the parameters, again. Yep, got an account, got a list name, got a code... So now we’re going to get ourselves a client! You know how it is. The HTTP protocol is stateless. So we have to redo it all: get the client credentials from the file. This time we have a code, which is cool, so authorise the client again. Now we get the real deal: the authorisation token. Well, in my case the Mastodon::Client library handles all the painful details. But here we are, now. We have a client with the token. We’re good to go!

Now the application starts remote-following the accounts in the list. We end our journey on the /do/follow route. The URL actually contains the code but not the token. I still replaced the client_id and the authorisation code in the log with XXX.

Here’s what the log says:

[Wed Sep 12 22:58:24 2018] [debug] GET "/follow_confirm" (4fa2b1fd)
[Wed Sep 12 22:58:24 2018] [debug] Routing to a callback
[Wed Sep 12 22:58:24 2018] [debug] Rendering cached template "follow_confirm.html.ep" from DATA section
[Wed Sep 12 22:58:24 2018] [debug] Rendering cached template "layouts/default.html.ep" from DATA section
[Wed Sep 12 22:58:24 2018] [debug] 200 OK (0.003705s, 269.906/s)
[Wed Sep 12 22:58:32 2018] [debug] GET "/auth" (9f1d8f22)
[Wed Sep 12 22:58:32 2018] [debug] Routing to a callback
[Wed Sep 12 22:58:32 2018] [debug] kensanata@octodon.social wants to authorize the 'follow' action for the Test list
[Wed Sep 12 22:58:32 2018] [debug] kensanata@octodon.social found client credentials for octodon.social: id yes, secret yes
[Wed Sep 12 22:58:32 2018] [debug] kensanata@octodon.social has a client: yes
[Wed Sep 12 22:58:32 2018] [debug] kensanata@octodon.social is being redirected to https://octodon.social/oauth/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_type=code&client_id=XXX&scope=follow+read+write
[Wed Sep 12 22:58:32 2018] [debug] 302 Found (0.024886s, 40.183/s)
[Wed Sep 12 22:58:32 2018] [debug] GET "/" (8a14f8db)
[Wed Sep 12 22:58:32 2018] [debug] Routing to a callback
[Wed Sep 12 22:58:32 2018] [debug] kensanata@octodon.social is authorized for the 'follow' action using the Test list, redirecting to /do/follow?code=XXX&account=kensanata%40octodon.social&name=Test&logging=ok
[Wed Sep 12 22:58:32 2018] [debug] 302 Found (0.000799s, 1251.564/s)
[Wed Sep 12 22:58:32 2018] [debug] GET "/do/follow" (b79fbbdb)
[Wed Sep 12 22:58:32 2018] [debug] Routing to a callback
[Wed Sep 12 22:58:32 2018] [debug] kensanata@octodon.social found client credentials for octodon.social: id yes, secret yes
[Wed Sep 12 22:58:32 2018] [debug] kensanata@octodon.social has a client: yes
[Wed Sep 12 22:58:32 2018] [debug] kensanata@octodon.social authorizing using a code: yes
[Wed Sep 12 22:58:33 2018] [debug] kensanata@octodon.social begins to follow 2 accounts from list Test
[Wed Sep 12 22:58:33 2018] [debug] kensanata@octodon.social followed 2 accounts from list Test
[Wed Sep 12 22:58:33 2018] [debug] Rendering template "follow_done.html.ep" from DATA section
[Wed Sep 12 22:58:33 2018] [debug] Rendering cached template "layouts/default.html.ep" from DATA section
[Wed Sep 12 22:58:33 2018] [debug] 200 OK (0.762821s, 1.311/s)

Tags:

Comments on 2018-09-12 OAuth and Mastodon

Did you try with scope written with %20 instead of +?

"&scope=follow+read+write"

Other than that this call fail:

redirect_uri=https%3A%2F%2Fcommunitywiki.org%2Ftrunk&response_type=code&client_id=xxxxxxxxxxxxxxxxxxx&scope=follow+read+write

If it’s not the scope, your client_id is no longer known by the instance. Did you try to register the app each time to see if the problem comes from your way of storing app clients?

https://github.com/tootsuite/documentation/blob/master/Using-the-API/API.md#apps

– tom79 2018-09-13 05:41 UTC


It also fails with a fresh client id due to a server side error on this callback for code:

https://communitywiki.org/trunk?code=XXXXXXXXXXXXXXXXXXXXXXX

Header:

Location: /trunk/do/follow?code=XXXXXXXXXXXXXXXXXXXXXXX&account=tom79%40ins.mastalab.app&name=Biology&logging=

– tom79 2018-09-13 05:54 UTC


Hm, I need better logging at that point: I see in my logs that you got a 500 error:

[Thu Sep 13 07:51:40 2018] [info] 178.209.50.237 GET http://communitywiki.org:8080/trunk/do/follow?code=XXXXXXXXXXXXXXXXXXXXXXX&account=tom79%40ins.mastalab.app&name=Biology&logging= 500 0.1443s

But that’s it. As far as I can tell from here, the flow looks correct: you did get authorised or the instance would not have sent you back to the redirect URL with a code. But it did, so that worked. So now the code is about to do this:

  1. get the authorisation token using the code it just got
  2. use the token to create the list, follow people and add these people to the list

– Alex Schroeder 2018-09-13 07:03 UTC


OK, I found a problem! I currently have 159 client credentials but when I look for duplicates, there’s a problem:

qoto.org 4
mastodon.social 23
ins.mastalab.app 2
mastodon.art 3
mstdn.io 2

This is obviously a problem because only one of them is going to be the correct client_secret.

Well, at least here’s a clue!

– Alex Schroeder 2018-09-13 07:16 UTC


OK, here’s something else: I while ago I tried to follow the Test list using kensanata@octodon.social and got the error “Authorisation failed. Did you try to reload the page? This will not work since we’re not saving the access token.” And just now I tried again and it worked. Clearly not the same error (since the authorisation seems to work) but disconcerting none the less.

– Alex Schroeder 2018-09-13 07:50 UTC


Improved logging, tried following the Test list using my account on humanities.one.

“Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method”

The log:

[Thu Sep 13 10:12:49 2018] [info] 178.209.50.237 GET http://communitywiki.org:8080/trunk/follow_confirm?account=kensanata%40humanities.one&name=Test 200 0.0223s
...
[Thu Sep 13 10:12:54 2018] [debug] GET "/trunk/auth" (8d6b9c08)
[Thu Sep 13 10:12:54 2018] [debug] Routing to a callback
[Thu Sep 13 10:12:54 2018] [debug] kensanata@humanities.one wants to authorize the 'follow' action for the Test list
[Thu Sep 13 10:12:54 2018] [debug] kensanata@humanities.one found client credentials for humanities.one: id yes, secret yes
[Thu Sep 13 10:12:54 2018] [debug] kensanata@humanities.one has a client: yes
[Thu Sep 13 10:12:54 2018] [debug] kensanata@humanities.one is being redirected to https://humanities.one/oauth/authorize?redirect_uri=https%3A%2F%2Fcommunitywiki.org%2Ftrunk&response_type=code&client_id=XXX&scope=follow+read+write
...
[Thu Sep 13 10:12:54 2018] [info] 178.209.50.237 GET http://communitywiki.org:8080/trunk/auth?account=kensanata%40humanities.one&action=follow&logging=ok&name=Test 302 0.0516s
...

And that’s the end of it! OK, let’s compare this with the flow I described: We have a client and we want to authorize it. We’re going to redirect the user to their instance. If they have the instance’s cookie set, they’re authorized immediately and should get back to our redirect URL (the / route).

But this is not what happens. We’re not being sent back to the redirect URL and the error is shown instead.

– Alex Schroeder 2018-09-13 08:27 UTC


I’m looking at some info @NicolasConstant kindly sent me and the URLs he uses are:

create new app:
    FORM POST
    https://[instance]/api/v1/apps

    form data: 

    client_name
    redirect_uris
    scopes
    website


redirect sign-in url:        
     https://[instance]/oauth/authorize?scope=[scopes]&response_type=code&redirect_uri=[redirect_uri]&client_id=[client_id]


access_token retrieval 
    POST
    https://[instance]/oauth/token?client_id=[client_id]&client_secret=[client_secret]&grant_type=authorization_code&code=[code]&redirect_uri=[redirect_uri]

API access : 
    In the headers:
    'Authorization': 'Bearer [access_token]'

In this case, we’re not yet at the access_token retrieval stage. We’re at the “redirect sign-in URL” stage: https://humanities.one/oauth/authorize?redirect_uri=https%3A%2F%2Fcommunitywiki.org%2Ftrunk&response_type=code&client_id=XXX&scope=follow+read+write matches https://[instance]/oauth/authorize?scope=[scopes]&response_type=code&redirect_uri=[redirect_uri]&client_id=[client_id].

So why is the server rejecting it?

Let’s try the following:

Just do it again. A temporary fluke? → fail

[Thu Sep 13 11:06:46 2018] [debug] Routing to a callback
[Thu Sep 13 11:06:46 2018] [debug] kensanata@humanities.one wants to authorize the 'follow' action for the Test list
[Thu Sep 13 11:06:46 2018] [debug] kensanata@humanities.one found client credentials for humanities.one: id yes, secret yes
[Thu Sep 13 11:06:46 2018] [debug] kensanata@humanities.one has a client: yes
[Thu Sep 13 11:06:46 2018] [debug] kensanata@humanities.one is being redirected to https://humanities.one/oauth/authorize?redirect_uri=https%3A%2F%2Fcommunitywiki.org%2Ftrunk&response_type=co
de&client_id=XXX&scope=follow+read+write
[Thu Sep 13 11:06:46 2018] [debug] 302 Found (0.04456s, 22.442/s)
[Thu Sep 13 11:06:46 2018] [info] 178.209.50.237 GET http://communitywiki.org:8080/trunk/auth?account=kensanata%40humanities.one&action=follow&logging=ok&name=Test 302 0.0488s

Delete the client credentials and do it again. Perhaps the client_id is no longer valid? → fail

[Thu Sep 13 11:07:21 2018] [debug] kensanata@humanities.one wants to authorize the 'follow' action for the Test list
[Thu Sep 13 11:07:21 2018] [debug] kensanata@humanities.one found no client credentials for YYY
[Thu Sep 13 11:07:22 2018] [debug] kensanata@humanities.one registered client and got new credentials for YYY: id yes, secret yes
[Thu Sep 13 11:07:22 2018] [debug] kensanata@humanities.one has a client: yes
[Thu Sep 13 11:07:22 2018] [debug] kensanata@humanities.one is being redirected to https://humanities.one/oauth/authorize?redirect_uri=https%3A%2F%2Fcommunitywiki.org%2Ftrunk&response_type=code&client_id=XXX&scope=follow+read+write
[Thu Sep 13 11:07:22 2018] [debug] 302 Found (0.182976s, 5.465/s)

Oops! What’s YYY doing here? I wonder. My log writing got confused. Will rewrite this section and try again.

– Alex Schroeder 2018-09-13 09:13 UTC


Still borked:

[Thu Sep 13 11:28:07 2018] [debug] GET "/trunk/auth" (a8dae4dc)
[Thu Sep 13 11:28:07 2018] [debug] Routing to a callback
[Thu Sep 13 11:28:07 2018] [debug] kensanata@humanities.one wants to authorize the 'follow' action for the Test list
[Thu Sep 13 11:28:07 2018] [debug] kensanata@humanities.one found client credentials for humanities.one: id yes, secret yes
[Thu Sep 13 11:28:07 2018] [debug] kensanata@humanities.one has a client: yes
[Thu Sep 13 11:28:07 2018] [debug] kensanata@humanities.one is being redirected to https://humanities.one/oauth/authorize?redirect_uri=https%3A%2F%2Fcommunitywiki.org%2Ftrunk&response_type=code&client_id=XXX&scope=follow+read+write
[Thu Sep 13 11:28:07 2018] [debug] 302 Found (0.043568s, 22.953/s)
[Thu Sep 13 11:28:07 2018] [info] 178.209.50.237 GET http://communitywiki.org:8080/trunk/auth?account=kensanata%40humanities.one&action=follow&logging=ok&name=Test 302 0.0520s

And after removing the credentials – it worked‽

[Thu Sep 13 11:29:38 2018] [debug] GET "/trunk/auth" (353e6e43)
[Thu Sep 13 11:29:38 2018] [debug] Routing to a callback
[Thu Sep 13 11:29:38 2018] [debug] kensanata@humanities.one wants to authorize the 'follow' action for the Test list
[Thu Sep 13 11:29:38 2018] [debug] kensanata@humanities.one found no client credentials for humanities.one
[Thu Sep 13 11:29:38 2018] [debug] kensanata@humanities.one registered client and got new credentials for humanities.one: id yes, secret yes
[Thu Sep 13 11:29:38 2018] [debug] kensanata@humanities.one has a client: yes
[Thu Sep 13 11:29:38 2018] [debug] kensanata@humanities.one is being redirected to https://humanities.one/oauth/authorize?redirect_uri=https%3A%2F%2Fcommunitywiki.org%2Ftrunk&response_type=co
de&client_id=XXX&scope=follow+read+write
[Thu Sep 13 11:29:38 2018] [debug] 302 Found (0.591784s, 1.690/s)
[Thu Sep 13 11:29:38 2018] [info] 178.209.50.237 GET http://communitywiki.org:8080/trunk/auth?account=kensanata%40humanities.one&action=follow&logging=ok&name=Test 302 0.6006s
[Thu Sep 13 11:29:42 2018] [debug] GET "/trunk" (2ca628ab)
[Thu Sep 13 11:29:42 2018] [debug] Routing to a callback
[Thu Sep 13 11:29:42 2018] [debug] kensanata@humanities.one is authorized for the 'follow' action using the Test list, redirecting to /trunk/do/follow?code=XXX&account=kensanata%40humanities.
one&name=Test&logging=ok
[Thu Sep 13 11:29:42 2018] [debug] 302 Found (0.001252s, 798.722/s)
[Thu Sep 13 11:29:42 2018] [info] 178.209.50.237 GET http://communitywiki.org:8080/trunk?code=XXX 302 0.0078s
[Thu Sep 13 11:29:42 2018] [debug] GET "/trunk/do/follow" (1d4bad6a)
[Thu Sep 13 11:29:42 2018] [debug] Routing to a callback
[Thu Sep 13 11:29:42 2018] [debug] kensanata@humanities.one found client credentials for humanities.one: id yes, secret yes
[Thu Sep 13 11:29:42 2018] [debug] kensanata@humanities.one has a client: yes
[Thu Sep 13 11:29:42 2018] [debug] kensanata@humanities.one authorizing using a code: yes
[Thu Sep 13 11:29:42 2018] [debug] kensanata@humanities.one begins to follow 4 accounts from list Test
[Thu Sep 13 11:29:45 2018] [debug] kensanata@humanities.one followed 4 accounts from list Test
[Thu Sep 13 11:29:45 2018] [debug] Rendering template "follow_done.html.ep" from DATA section
[Thu Sep 13 11:29:45 2018] [debug] Rendering cached template "layouts/default.html.ep" from DATA section
[Thu Sep 13 11:29:45 2018] [debug] 200 OK (3.888279s, 0.257/s)
[Thu Sep 13 11:29:45 2018] [info] 178.209.50.237 GET http://communitywiki.org:8080/trunk/do/follow?code=XXX&account=kensanata%40humanities.one&name=Test&logging=ok 200 3.8928s

Hm. I am convinced that my rewriting just changed the way things are being logged. Just to be sure, though, I will delete all the client credentials (except for the one I just saved) and we’ll see whether the situation improves.

– Alex Schroeder 2018-09-13 09:38 UTC


I tested and it now works as expected.

– tom79 2018-09-13 11:15 UTC


Amazing. 🤷‍♂️

– Alex Schroeder 2018-09-13 13:51 UTC

Add Comment

More...

Comments


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.