Description:
------------
OAuth signing method does not include any values prefixed with 'oauth_' in the calculated signature.

Test script outputs the following;
Signature(1): Y3xNMbD5FDK6lsLcDgmR5D/Ts5c=
Signature(2): NDLLGgcJPAUycPAEkdOSwyAEtfA=
Signature(3): NDLLGgcJPAUycPAEkdOSwyAEtfA=

Using the example from http://www.imsglobal.org/lti/blti/bltiv1p0/ltiBLTIimgv1p0.html#_Toc261271993

I cannot create a signature that matches.

Also referencing Twitter API https://dev.twitter.com/docs/auth/creating-signature under the section "Collecting parameters" they have the following "In addition to the request parameters, every oauth_* parameter needs to be included in the signature, so collect those too"


AFAICT the only parameter that should be ignored is the oauth_signature value. All other parameters should be included in calculating the signature.


Test script:
---------------
<?php
$oauth = new OAUTH('12345', 'secret');
$oauth->enableDebug();
$oauth->setNonce('c8350c0e47782d16d2fa48b2090c1d8f');
$oauth->setVersion('1.0');
$oauth->setTimestamp('1251600739');
$oauth->setAuthType(OAUTH_AUTH_TYPE_NONE);
$params = array(
  "basiclti_submit" => "Launch Endpoint with BasicLTI Data",
  "context_id" => "456434513",
  "context_label" => "SI182",
  "context_title" => "Design of Personal Environments",
  "lis_person_contact_email_primary" => "user@school.edu",
  "lis_person_name_full" => "Jane Q. Public",
  "lis_person_sourced_id" => "school.edu:Auser",
  "lti_message_type" => "basic-lti-launch-request",
  "lti_version" => "LTI-1p0",
  "oauth_consumer_key" => "12345",
  "oauth_nonce" => "c8350c0e47782d16d2fa48b2090c1d8f",
  "oauth_signature_method" => "HMAC-SHA1",
  "oauth_timestamp" => "1251600739",
  "oauth_version" => "1.0",
  "oauth_signature" => "TPFPK4u3NwmtLt0nDMP1G1zG30U=",
  "resource_link_id" => "120988f929-274612",
  "roles" => "Instructor",
  "tool_consumer_instance_description" => "University of School (LMSng)",
  "tool_consumer_instance_guid" => "lmsng.school.edu",
  "user_id" => "292832126",
);
$signature = $oauth->generateSignature(OAUTH_HTTP_METHOD_POST, 'http://dr-chuck.com/ims/php-simple/tool.php', $params);
echo "Signature(1): $signature<br />\n";

$params['context_label'] = 'test';
$signature = $oauth->generateSignature(OAUTH_HTTP_METHOD_POST, 'http://dr-chuck.com/ims/php-simple/tool.php', $params);
echo "Signature(2): $signature<br />\n";

$params['oauth_nonce'] = 'a';
$params['oauth_version'] = 'invalid';
$params['oauth_timestamp'] = '1234567890';
$signature = $oauth->generateSignature(OAUTH_HTTP_METHOD_POST, 'http://dr-chuck.com/ims/php-simple/tool.php', $params);
echo "Signature(3): $signature<br />\n";

?>


Expected result:
----------------
All three signatures would be different.

Actual result:
--------------
Signature 2 and 3 were the same.