paliarush/OauthClient.php

## checklogin.php
<?php
require './vendor/autoload.php';

$consumerKey = $_REQUEST['oauth_consumer_key'];
$callback = $_REQUEST['callback_url'];

session_id('test');
session_start();

/** Use $consumerKey to retrieve the following data in case it was stored in DB when received at "endpoint.php" */
if ($consumerKey !== $_SESSION['oauth_consumer_key']) {
    throw new \Exception("Consumer keys received on on different requests do not match.");
}

$consumerSecret = $_SESSION['oauth_consumer_secret'];
$magentoBaseUrl = rtrim($_SESSION['store_base_url'], '/');
$oauthVerifier = $_SESSION['oauth_verifier'];

define('TESTS_BASE_URL', $magentoBaseUrl);

$credentials = new \OAuth\Common\Consumer\Credentials($consumerKey, $consumerSecret, $magentoBaseUrl);
$oAuthClient = new OauthClient($credentials);
$requestToken = $oAuthClient->requestRequestToken();
$accessToken = $oAuthClient->requestAccessToken(
    $requestToken->getRequestToken(),
    $oauthVerifier,
    $requestToken->getRequestTokenSecret()
);

header("location: $callback");

## endpoint.php
<?php
session_id('test');
session_start();

// In case of storage these data in DB, oauth_consumer_key can be used as ID to retrieve this data later in "checklogin.php"
// For simplicity of this sample it is stored in session
$_SESSION['oauth_consumer_key'] = $_POST['oauth_consumer_key'];

$_SESSION['oauth_consumer_secret'] = $_POST['oauth_consumer_secret'];
$_SESSION['store_base_url'] = $_POST['store_base_url'];
$_SESSION['oauth_verifier'] = $_POST['oauth_verifier'];

session_write_close();

header("HTTP/1.0 200 OK");
echo "Response";

## login.php
<?php
$consumerKey = $_REQUEST['oauth_consumer_key'];
$callbackUrl = urlencode(urldecode($_REQUEST['success_call_back']));

echo <<<HTML
<table width="300" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
    <tr>
        <form name="form1" method="post" action="checklogin.php?oauth_consumer_key={$consumerKey}&callback_url={$callbackUrl}">
            <td>
                <table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
                    <tr>
                        <td colspan="3"><strong>Integrations Login</strong></td>
                    </tr>
                    <tr>
                        <td width="78">Username</td>
                        <td width="6">:</td>
                        <td width="294"><input name="myusername" type="text" id="myusername"></td>
                    </tr>
                    <tr>
                        <td>Password</td>
                        <td>:</td>
                        <td><input name="mypassword" type="text" id="mypassword"></td>
                    </tr>
                    <tr>
                        <td>&nbsp;</td>
                        <td>&nbsp;</td>
                        <td><input type="submit" name="Submit" value="Login"></td>
                    </tr>
                </table>
            </td>
        </form>
    </tr>
</table>
HTML;

## OauthClient.php
<?php

use OAuth\Common\Consumer\Credentials;
use OAuth\Common\Http\Client\ClientInterface;
use OAuth\Common\Http\Exception\TokenResponseException;
use OAuth\Common\Http\Uri\Uri;
use OAuth\Common\Http\Uri\UriInterface;
use OAuth\Common\Storage\TokenStorageInterface;
use OAuth\OAuth1\Service\AbstractService;
use OAuth\OAuth1\Signature\SignatureInterface;
use OAuth\OAuth1\Token\StdOAuth1Token;
use OAuth\OAuth1\Token\TokenInterface;

class OauthClient extends AbstractService
{
    /** @var string|null */
    protected $_oauthVerifier = null;

    public function __construct(
        Credentials $credentials,
        ClientInterface $httpClient = null,
        TokenStorageInterface $storage = null,
        SignatureInterface $signature = null,
        UriInterface $baseApiUri = null
    ) {
        if (!isset($httpClient)) {
            $httpClient = new \OAuth\Common\Http\Client\StreamClient();
        }
        if (!isset($storage)) {
            $storage = new \OAuth\Common\Storage\Session();
        }
        if (!isset($signature)) {
            $signature = new \OAuth\OAuth1\Signature\Signature($credentials);
        }
        parent::__construct($credentials, $httpClient, $storage, $signature, $baseApiUri);
    }

    /**
     * @return UriInterface
     */
    public function getRequestTokenEndpoint()
    {
        return new Uri('http://magento.ll/oauth/token/request');
    }

    /**
     * Returns the authorization API endpoint.
     *
     * @throws \OAuth\Common\Exception\Exception
     */
    public function getAuthorizationEndpoint()
    {
        throw new \OAuth\Common\Exception\Exception(
            'Magento REST API is 2-legged. Current operation is not available.'
        );
    }

    /**
     * Returns the access token API endpoint.
     *
     * @return UriInterface
     */
    public function getAccessTokenEndpoint()
    {
        return new Uri('http://magento.ll/oauth/token/access');
    }

    /**
     * Parses the access token response and returns a TokenInterface.
     *
     * @param string $responseBody
     * @return TokenInterface
     */
    protected function parseAccessTokenResponse($responseBody)
    {
        return $this->_parseToken($responseBody);
    }

    /**
     * Parses the request token response and returns a TokenInterface.
     *
     * @param string $responseBody
     * @return TokenInterface
     * @throws TokenResponseException
     */
    protected function parseRequestTokenResponse($responseBody)
    {
        $data = $this->_parseResponseBody($responseBody);
        if (isset($data['oauth_verifier'])) {
            $this->_oauthVerifier = $data['oauth_verifier'];
        }
        return $this->_parseToken($responseBody);
    }

    /**
     * Parse response body and create oAuth token object based on parameters provided.
     *
     * @param string $responseBody
     * @return StdOAuth1Token
     * @throws TokenResponseException
     */
    protected function _parseToken($responseBody)
    {
        $data = $this->_parseResponseBody($responseBody);
        $token = new StdOAuth1Token();
        $token->setRequestToken($data['oauth_token']);
        $token->setRequestTokenSecret($data['oauth_token_secret']);
        $token->setAccessToken($data['oauth_token']);
        $token->setAccessTokenSecret($data['oauth_token_secret']);
        $token->setEndOfLife(StdOAuth1Token::EOL_NEVER_EXPIRES);
        unset($data['oauth_token'], $data['oauth_token_secret']);
        $token->setExtraParams($data);
        return $token;
    }

    /**
     * Parse response body and return data in array.
     *
     * @param string $responseBody
     * @return array
     * @throws \OAuth\Common\Http\Exception\TokenResponseException
     */
    protected function _parseResponseBody($responseBody)
    {
        if (!is_string($responseBody)) {
            throw new TokenResponseException("Response body is expected to be a string.");
        }
        parse_str($responseBody, $data);
        if (null === $data || !is_array($data)) {
            throw new TokenResponseException('Unable to parse response.');
        } elseif (isset($data['error'])) {
            throw new TokenResponseException("Error occurred: '{$data['error']}'");
        }
        return $data;
    }

    /**
     * @override to fix since parent implementation from lib not sending the oauth_verifier when requesting access token
     * Builds the authorization header for an authenticated API request
     *
     * @param string $method
     * @param UriInterface $uri the uri the request is headed
     * @param \OAuth\OAuth1\Token\TokenInterface $token
     * @param $bodyParams array
     * @return string
     */
    protected function buildAuthorizationHeaderForAPIRequest(
        $method,
        UriInterface $uri,
        TokenInterface $token,
        $bodyParams = null
    ) {
        $this->signature->setTokenSecret($token->getAccessTokenSecret());
        $parameters = $this->getBasicAuthorizationHeaderInfo();
        if (isset($parameters['oauth_callback'])) {
            unset($parameters['oauth_callback']);
        }

        $parameters = array_merge($parameters, ['oauth_token' => $token->getAccessToken()]);
        $parameters = array_merge($parameters, $bodyParams);
        $parameters['oauth_signature'] = $this->signature->getSignature($uri, $parameters, $method);

        $authorizationHeader = 'OAuth ';
        $delimiter = '';

        foreach ($parameters as $key => $value) {
            $authorizationHeader .= $delimiter . rawurlencode($key) . '="' . rawurlencode($value) . '"';
            $delimiter = ', ';
        }

        return $authorizationHeader;
    }
}
	<?php
	require './vendor/autoload.php';

	$consumerKey = $_REQUEST['oauth_consumer_key'];
	$callback = $_REQUEST['callback_url'];

	session_id('test');
	session_start();

	/** Use $consumerKey to retrieve the following data in case it was stored in DB when received at "endpoint.php" */
	if ($consumerKey !== $_SESSION['oauth_consumer_key']) {
	throw new \Exception("Consumer keys received on on different requests do not match.");
	}

	$consumerSecret = $_SESSION['oauth_consumer_secret'];
	$magentoBaseUrl = rtrim($_SESSION['store_base_url'], '/');
	$oauthVerifier = $_SESSION['oauth_verifier'];

	define('TESTS_BASE_URL', $magentoBaseUrl);

	$credentials = new \OAuth\Common\Consumer\Credentials($consumerKey, $consumerSecret, $magentoBaseUrl);
	$oAuthClient = new OauthClient($credentials);
	$requestToken = $oAuthClient->requestRequestToken();
	$accessToken = $oAuthClient->requestAccessToken(
	$requestToken->getRequestToken(),
	$oauthVerifier,
	$requestToken->getRequestTokenSecret()
	);

	header("location: $callback");
	<?php
	$consumerKey = $_REQUEST['oauth_consumer_key'];
	$callbackUrl = urlencode(urldecode($_REQUEST['success_call_back']));

	echo <<<HTML
	<table width="300" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#CCCCCC">
	<tr>
	<form name="form1" method="post" action="checklogin.php?oauth_consumer_key={$consumerKey}&callback_url={$callbackUrl}">
	<td>
	<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
	<tr>
	<td colspan="3"><strong>Integrations Login</strong></td>
	</tr>
	<tr>
	<td width="78">Username</td>
	<td width="6">:</td>
	<td width="294"><input name="myusername" type="text" id="myusername"></td>
	</tr>
	<tr>
	<td>Password</td>
	<td>:</td>
	<td><input name="mypassword" type="text" id="mypassword"></td>
	</tr>
	<tr>
	<td> </td>
	<td> </td>
	<td><input type="submit" name="Submit" value="Login"></td>
	</tr>
	</table>
	</td>
	</form>
	</tr>
	</table>
	HTML;
	<?php

	use OAuth\Common\Consumer\Credentials;
	use OAuth\Common\Http\Client\ClientInterface;
	use OAuth\Common\Http\Exception\TokenResponseException;
	use OAuth\Common\Http\Uri\Uri;
	use OAuth\Common\Http\Uri\UriInterface;
	use OAuth\Common\Storage\TokenStorageInterface;
	use OAuth\OAuth1\Service\AbstractService;
	use OAuth\OAuth1\Signature\SignatureInterface;
	use OAuth\OAuth1\Token\StdOAuth1Token;
	use OAuth\OAuth1\Token\TokenInterface;

	class OauthClient extends AbstractService
	{
	/** @var string\|null */
	protected $_oauthVerifier = null;

	public function __construct(
	Credentials $credentials,
	ClientInterface $httpClient = null,
	TokenStorageInterface $storage = null,
	SignatureInterface $signature = null,
	UriInterface $baseApiUri = null
	) {
	if (!isset($httpClient)) {
	$httpClient = new \OAuth\Common\Http\Client\StreamClient();
	}
	if (!isset($storage)) {
	$storage = new \OAuth\Common\Storage\Session();
	}
	if (!isset($signature)) {
	$signature = new \OAuth\OAuth1\Signature\Signature($credentials);
	}
	parent::__construct($credentials, $httpClient, $storage, $signature, $baseApiUri);
	}

	/**
	* @return UriInterface
	*/
	public function getRequestTokenEndpoint()
	{
	return new Uri('http://magento.ll/oauth/token/request');
	}

	/**
	* Returns the authorization API endpoint.
	*
	* @throws \OAuth\Common\Exception\Exception
	*/
	public function getAuthorizationEndpoint()
	{
	throw new \OAuth\Common\Exception\Exception(
	'Magento REST API is 2-legged. Current operation is not available.'
	);
	}

	/**
	* Returns the access token API endpoint.
	*
	* @return UriInterface
	*/
	public function getAccessTokenEndpoint()
	{
	return new Uri('http://magento.ll/oauth/token/access');
	}

	/**
	* Parses the access token response and returns a TokenInterface.
	*
	* @param string $responseBody
	* @return TokenInterface
	*/
	protected function parseAccessTokenResponse($responseBody)
	{
	return $this->_parseToken($responseBody);
	}

	/**
	* Parses the request token response and returns a TokenInterface.
	*
	* @param string $responseBody
	* @return TokenInterface
	* @throws TokenResponseException
	*/
	protected function parseRequestTokenResponse($responseBody)
	{
	$data = $this->_parseResponseBody($responseBody);
	if (isset($data['oauth_verifier'])) {
	$this->_oauthVerifier = $data['oauth_verifier'];
	}
	return $this->_parseToken($responseBody);
	}

	/**
	* Parse response body and create oAuth token object based on parameters provided.
	*
	* @param string $responseBody
	* @return StdOAuth1Token
	* @throws TokenResponseException
	*/
	protected function _parseToken($responseBody)
	{
	$data = $this->_parseResponseBody($responseBody);
	$token = new StdOAuth1Token();
	$token->setRequestToken($data['oauth_token']);
	$token->setRequestTokenSecret($data['oauth_token_secret']);
	$token->setAccessToken($data['oauth_token']);
	$token->setAccessTokenSecret($data['oauth_token_secret']);
	$token->setEndOfLife(StdOAuth1Token::EOL_NEVER_EXPIRES);
	unset($data['oauth_token'], $data['oauth_token_secret']);
	$token->setExtraParams($data);
	return $token;
	}

	/**
	* Parse response body and return data in array.
	*
	* @param string $responseBody
	* @return array
	* @throws \OAuth\Common\Http\Exception\TokenResponseException
	*/
	protected function _parseResponseBody($responseBody)
	{
	if (!is_string($responseBody)) {
	throw new TokenResponseException("Response body is expected to be a string.");
	}
	parse_str($responseBody, $data);
	if (null === $data \|\| !is_array($data)) {
	throw new TokenResponseException('Unable to parse response.');
	} elseif (isset($data['error'])) {
	throw new TokenResponseException("Error occurred: '{$data['error']}'");
	}
	return $data;
	}

	/**
	* @override to fix since parent implementation from lib not sending the oauth_verifier when requesting access token
	* Builds the authorization header for an authenticated API request
	*
	* @param string $method
	* @param UriInterface $uri the uri the request is headed
	* @param \OAuth\OAuth1\Token\TokenInterface $token
	* @param $bodyParams array
	* @return string
	*/
	protected function buildAuthorizationHeaderForAPIRequest(
	$method,
	UriInterface $uri,
	TokenInterface $token,
	$bodyParams = null
	) {
	$this->signature->setTokenSecret($token->getAccessTokenSecret());
	$parameters = $this->getBasicAuthorizationHeaderInfo();
	if (isset($parameters['oauth_callback'])) {
	unset($parameters['oauth_callback']);
	}

	$parameters = array_merge($parameters, ['oauth_token' => $token->getAccessToken()]);
	$parameters = array_merge($parameters, $bodyParams);
	$parameters['oauth_signature'] = $this->signature->getSignature($uri, $parameters, $method);

	$authorizationHeader = 'OAuth ';
	$delimiter = '';

	foreach ($parameters as $key => $value) {
	$authorizationHeader .= $delimiter . rawurlencode($key) . '="' . rawurlencode($value) . '"';
	$delimiter = ', ';
	}

	return $authorizationHeader;
	}
	}