Tumblr Connect has stopped working for us. The last successful post to our account was post was September 3, which appears to correspond with the termination of authenticated API v1 requests.

Is anyone else seeing this? Does this module need to be updated to the Tumblr API v2? Or is this just a coincidence? (It's possible that this was due to something on our end, but we weren't messing with Tumblr Connect around that date.)

Comments

mpaler’s picture

mpaler commented

I can confirm the my tumblr connect dying on the same date. I most definitely has to do with the change in the Tumblr API.

lorinpda’s picture

lorinpda commented
Assigned: Unassigned » lorinpda
Category: support » bug

Hi,
My apologies for not responding sooner. Been unavailable and now "under the weather" :(

Yes, Tumblr changed it's "application program interface" (API).

What that means is, the current version of "Tumblr Connect" can not perform it's tasks.

The Tumblr API is what "Tumblr" Connect communicates with. What I need to do is analyze the scope of the changes. Determine which services Tumblr is continuing to offer, which services are no longer available.

The original Tumblr API allowed us to automatically (computer to computer) login to Tumblr. My preliminary analysis leads me to believe that Tumblr now requires a manual login to Tumblr (I.E. a temporary login page is generated for all operations). Again, this is preliminary, and may be totally wrong. If I am correct, then many of the "Tumblr Connect" features of (e.g. automatic recovery via a cron processing) is simply no longer available.

What would help is, can anyone post a link which discusses why Tumblr changed it's API. Tumblr is a great service, I am sure they have a very good reason. A review of Tumblr's reasons might expedite the impact analysis (and ultimately a fix).

Again, my apologies for not responding sooner. I'll provide an update as soon as possible.

Lorin

greenreaper’s picture

greenreaper
Primary language English
Location Welling, Bexley, London
commented

Well, the simple reason is that they don't want people sending user login credentials over the Internet, or giving them to application builders. Instead, they want you to use OAuth, which allows you to send a signing blob in the Authorization: header instead by using a shared unique secret. This is laid out in the 2.0 API link above. It is the way such services have been moving over the last few years.

Most likely, Tumblr Connect will need to use the OAuth standard to communicate with Tumblr, probably using the OAuth module. I don't know the details of OAuth, but it does not preclude automatic posting. It may require some initial setup on the part of the user.

lorinpda’s picture

lorinpda commented

Hi,
Thanks for the feedback. I get the part about what you send to Tumblr. via QAuth, However, what's nor clear to me, at all, is what is handed back.

Sorry, all the QAuth examples I've seen, are very foggy and ambiguous. They all end up with a manual intervention by the end user (I.E. like a token for a temporary login) before an operation is allowed on the end-point service (in this case Tumblr).

Have you experienced anything different? Do you know for certain what the work flow is.

The use case for Tumblr Connect was to post to Tumblr transparently. No intervention by the end user. So, I am very concerned that QAuth prohibits that type of transparent communication.

Again, thank you for the feedback, Any elaboration of clarification would be greatly appreciated:)

greenreaper’s picture

greenreaper
Primary language English
Location Welling, Bexley, London
commented

I don't have any personal experience developing for it, but OAuth for Dummies seems like a reasonable summary.

I suspect the site owner will have to go through setup redirecting to Tumblr and back again at least once - that's kind of the point. But they should not have to do it every time they want to post.

I notice the OAuth module suggests at OAuth Connector, but that module doesn't have a stable release or recent commits, and there are a number of issues.

lorinpda’s picture

lorinpda commented

Hi,
Thanks for the feedback and the links.

I found a good explanation on "Zend Framework"'s website. That explanation differentiates between the 2 major processes (use cases):
1) Registering an QAuth account (i.E. obtaining an encrypted/signed key token).
2) Using the QAuth account (I.E. using the key).

The registration process requires the end user (in our case the Drupal site admin) to visit Tumblr's website and register their QAuth account.

Later, when a Drupal user posts a "story", the Drupal website sends Tumblr the QAuth key (I.E. uses the key). Sending the key is transparent (just like the original version of Tumblr Connect).

There is a time duration (I.E. expiration date) associated with a QAuth key. It's up to the service provider (Tumblr) to decide whether and how to exercise the time constraint. I've read that most providers do not exercise the time constraint. However, technically, that time constraint can be exercised (just like the time constraint of a standard HTTP session),

In addition, there a different versions of QAuth. I believe the latest version is 2.0. Tumble currently is using an earlies 1.x version. The QAuth version becomes a factor when deciding to use another Drupal contributed module's implementation of QAuth. We have to look at what version of QAuth they've implemented.

Finally, we have to consider how many Drupal site administrators are willing to go through the Tumblr application registration process. To me, that registration process is designed for other service providers. To me, a Drupal website is not a "service provider". That brings up potential support issues. I just wanted to mention that here, in case other folks wanted to chime in :)

Again, thank you for the information. Because of resource constraints, I haven't completed the impact analysis. I am working on it (when I can) :)

lorinpda’s picture

lorinpda commented

Hi,
A quick follow up to my last message.

Creating s Tumblr "application" account is a separate step.

So a Drupal site administrator would need to:

  • Create a standard Tumblr Account.
  • Create a Tumblr "application" Account
  • Register (enable) the Tumblr "application" Account
  • Configure and enable Tumblr Connect

Sorry, I wanted to clarify that Creating the Tumblr application account and Registering the Tumblr application account are two separate and distinct actions.

greenreaper’s picture

greenreaper
Primary language English
Location Welling, Bexley, London
commented

One rather important impact - cron appears to be blocking on tumblr_connect and failing to complete, breaking every cron module after it in the sequence. This can cause serious performance issues over time, including Apache process bloat and leftover SQL connections. Because of this, I have disabled the Tumblr Connect module and would suggest that others do so until this issue is resolved.

DanielJohnston’s picture

DanielJohnston commented
Priority: Normal » Critical

It may make sense to update the tumblr_connect module description to highlight that the module is currently not working, and may also break websites that it's installed on as described in #8. It also seems that this can fairly be described as a critical bug, for those reasons.

I've just used OAuth module and the Twitter module to set up automated twitter posting of new stories on a site I'm developing. It's a far more secure option, and I particularly like the optional posting tab that appears on node creation / editing for selected content types. It may be a good idea to borrow some stuff from the Twitter module's implementation of posting via OAuth. Good luck!

empowerbop’s picture

empowerbop commented

This connector can be really useful.. But, I am finding same issue. I gather from the thread that author is already aware. Is there any update, if this is going to be release in next month or two? It seems that connector is a best approach anyway so I am not even sure if there are any alternatives!

greenreaper’s picture

greenreaper
Primary language English
Location Welling, Bexley, London
commented

The Twitter module has a class in twitter.lib.php, TwitterOAuth, that extends its main class to provide OAuth services using the OAuth module. This looks to be a relatively easy method of implementation which I urge the module developer to consider copying, if possible.

Use of this module has declined to 100 sites from a high of 148 (which was rapidly rising) because it is not working and in fact actively causes performance problems because of stuck cron tasks.

Rhino-new’s picture

Rhino-new commented
Issue summary: View changes

This is sadly still not working. Just tested my first fresh install. Nothing is posting to tumblr.

For workaround try IFFT