Make sure that your $extra_parameters is an array.
If it's not, then OAuth will silently skip the malformed data type and produce a signature base string that is invalid (doesn't contain POST parameters, as defined in the RFC).
You should file a critical bug report against any REST API you find in the wild that accepts such a bogus signature to pass authentication.