title: Unable to use PLAINTEXT signature with a DotNetOpenAuth ServiceProvider
body: <p>I am building an <a href="http://oauth.net/core/1.0a"><code>OAuth 1.0(a)</code></a> authorization server using <a href="http://www.dotnetopenauth.net/"><code>DotNetOpenAuth</code></a> (NuGet package <code>DotNetOpenAuth.OAuth.ServiceProvider, version = 4.1.4.12333</code>). The server is hosted in an ASP.NET application but that's irrelevant to the question.</p>
  
  <p>My <a href="https://github.com/AArnott/dotnetopenid/blob/master/src/DotNetOpenAuth.OAuth.ServiceProvider/OAuth/ServiceProvider.cs"><code>ServiceProvider</code></a> is configured like this:</p>
  
  <pre><code>private ServiceProvider GetServiceProvider()
  {
      var baseUri = "http://myauth.com";
      return new ServiceProvider(
          new ServiceProviderDescription
          {
              UserAuthorizationEndpoint = new MessageReceivingEndpoint(
                  new Uri(baseUri + "/get_request_token"), 
                  HttpDeliveryMethods.GetRequest
              ),
              RequestTokenEndpoint = new MessageReceivingEndpoint(
                  new Uri(baseUri + "/authorize"), 
                  HttpDeliveryMethods.PostRequest
              ),
              AccessTokenEndpoint = new MessageReceivingEndpoint(
                  new Uri(baseUri + "/get_token"), 
                  HttpDeliveryMethods.PostRequest
              ),
              ProtocolVersion = ProtocolVersion.V10a,
              TamperProtectionElements = new ITamperProtectionChannelBindingElement[] 
              {
                  new PlaintextSigningBindingElement(),
                  new HmacSha1SigningBindingElement(),
              },
          },
          tokenManager,
          new OAuthServiceProviderMessageFactory(tokenManager)
      );
  }
  </code></pre>
  
  <p>The relevant part of my <code>get_request_token</code> endpoint looks like this:</p>
  
  <pre><code>var serviceProvider = GetServiceProvider();
  var tokenRequest = serviceProvider.ReadTokenRequest();
  </code></pre>
  
  <p>Now when a consumer sends the following request to this endpoint:</p>
  
  <pre><code>GET /get_request_token?oauth_nonce=C5657420BCE5F3224914304376B5334696B09B7FFC17C105A7F9629A008869DC&amp;oauth_timestamp=1356006599&amp;oauth_consumer_key=sampleconsumer&amp;oauth_signature_method=plaintext&amp;oauth_signature=samplesecret%26&amp;oauth_version=1.0&amp;oauth_callback=http%3a%2f%2flocalhost%3a30103%2fCustomOAuth1 HTTP/1.1
  
  Host: localhost:8180
  Connection: close
  </code></pre>
  
  <p>(broken for clarity):</p>
  
  <pre><code>oauth_nonce=C5657420BCE5F3224914304376B5334696B09B7FFC17C105A7F9629A008869DC
  oauth_timestamp=1356006599
  oauth_consumer_key=sampleconsumer
  oauth_signature_method=plaintext
  oauth_signature=samplesecret%26
  oauth_version=1.0
  oauth_callback=http%3a%2f%2flocalhost%3a30103%2fCustomOAuth1
  </code></pre>
  
  <p>The <code>serviceProvider.ReadTokenRequest()</code> method throws an exception:</p>
  
  <pre><code>The UnauthorizedTokenRequest message required protections {All} but the channel could only apply {Expiration, ReplayProtection}.
     at DotNetOpenAuth.Messaging.Channel.ProcessIncomingMessage(IProtocolMessage message)
     at DotNetOpenAuth.Messaging.Channel.ReadFromRequest(HttpRequestBase httpRequest)
     at DotNetOpenAuth.Messaging.Channel.TryReadFromRequest[TRequest](HttpRequestBase httpRequest, TRequest&amp; request)
     at DotNetOpenAuth.OAuth.ServiceProvider.ReadTokenRequest(HttpRequestBase request)
     at DotNetOpenAuth.OAuth.ServiceProvider.ReadTokenRequest()
     at OAuthServers.OAuth1.Services.OAuth1Service.Any(GetRequestTokenRequest request)
     at lambda_method(Closure , Object , Object )
     at ServiceStack.ServiceHost.ServiceRunner`1.Execute(IRequestContext requestContext, Object instance, TRequest request)
  </code></pre>
  
  <p>On the other hand if the client sends the following request:</p>
  
  <pre><code>GET /get_request_token?oauth_callback=http%3a%2f%2flocalhost%3a65271%2foauth1%2fHandleAccessToken&amp;oauth_consumer_key=sampleconsumer&amp;oauth_nonce=rGFvxlWm&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_signature=HV%2f5Vq%2b0cF3NrtiISE9k4jmgCrY%3d&amp;oauth_version=1.0&amp;oauth_timestamp=1356007830 HTTP/1.1
  
  Host: localhost:8180
  Connection: close
  </code></pre>
  
  <p>(broken for clarity):</p>
  
  <pre><code>oauth_callback=http%3a%2f%2flocalhost%3a65271%2foauth1%2fHandleAccessToken
  oauth_consumer_key=sampleconsumer
  oauth_nonce=rGFvxlWm
  oauth_signature_method=HMAC-SHA1
  oauth_signature=HV%2f5Vq%2b0cF3NrtiISE9k4jmgCrY%3d
  oauth_version=1.0
  oauth_timestamp=1356007830
  </code></pre>
  
  <p>it succeeds. </p>
  
  <p>As you can see the only difference between those 2 requests is the <code>oauth_signature_method</code> being used. In the first case <code>PLAINTEXT</code> is used whereas in the second <code>HMAC-SHA1</code>.</p>
  
  <p>Is it possible to make DotNetOpenAuth accept a <code>PLAINTEXT</code> signature method for the request token endpoint along with the GET verb (even if the <a href="http://oauth.net/core/1.0a/#rfc.section.6.1.1"><code>OAuth 1.0(a) specification</code></a> recommends POST to be used for this endpoint)? Is there some config option that could <em>relax</em> this requirement on the server? </p>
  
  <p>At the moment modifying the client is not an option for me.</p>