Recently active topics in OAuth about Consumer Service

When researching the issue I reported earlier (http://getsatisfaction.com/oauth/topi...) I tried to go reference the code samples in the code section of the OAuth website and came across all of the libraries with their various incarnations of the signing. For example, I drew up the following explaining how each of the various libraries build the signature base string:

Python:
- endpoint
- normalized request parameters
- http method
- consumer secret
- token secret

Ruby (oauth.rb)
- consumer secret
- consumer key
- token
- token secret
- http method
- endpoint
- normalized request parameters
- nonce
- timestamp

This version seems to be out of sync with the spec, and appears to be superceded by the gem version in the oauth folder underneath the ruby section. Also note that rather than combining each element of the signature base string with an ampersand, this code created key value pairs, url-encoded style, which it then combines with ampersands.

oauth.rb: request_method=GET&request_uri=http://foo.com
the spec's: GET&http://foo.com
Please note i'm not uri encoding the above string.

It seems like this file should removed from the code repo, since it confused me and possibly has confused others.

Ruby (oauth rubygem)

This version seems to match the spec, except for some bugs in the signature classes (hmac_class is self-referential instead of to the concrete implementations, which don't seem to exist).

PHP (OAuth.php in the google code project)
- consumer secret
- consumer key
- token
- token secret
- http method
- endpoint
- normalized request parameters
- timestamp
- nonce

PHP (http://teczno.com/HTTP_Request_Oauth....)
- This matches the spec as far as I can tell

Perl
- This matches the spec as far as I can tell

C#
- This matches the spec as far as I can tell, with the exception that is it doesn't have a facility for signing requests with form bodies

Of the 7 versions I showed here, less than half of them can be used to generate a valid oauth signature at present. Or at least a valid OAuth signature as I understand the spec. Given that, someone coming into the system clean (like me) can get really confused (which I did :)).

That was quite a lot of text before I got to my point, but to me it seems like there should be a page out there on the oauth.net websites that has a up to date status on each of the available code libraries. Such a page would really go a long way to help people no where they should go to learn this spec.

How does OAuth compare and contrast with OpenID?

I understand that OpenID provides a way for a user to provide a distributed authentication mechanism, which OAuth covers as well. I also believe that OAuth goes further in some respects by documenting things that OpenID leaves up to the providers. Is this accurate?

Are there any other ways that these two systems compare and contrast?