Ignore:
Timestamp:
2024-02-21T21:26:18+01:00 (3 months ago)
Author:
taylor.smock
Message:

Fix #22810: OSM OAuth 1.0a/Basic auth deprecation and removal

As of 2024-02-15, something changed in the OSM server configuration. This broke
our OAuth 1.0a implementation (see #23475). As such, we are removing OAuth 1.0a
from JOSM now instead of when the OSM server removes support in June 2024.

For third-party OpenStreetMap servers, the Basic Authentication method has been
kept. However, they should be made aware that it may be removed if a non-trivial
bug occurs with it. We highly recommend that the third-party servers update to
the current OpenStreetMap website implementation (if only for their own security).

Failing that, the third-party server can implement RFC8414. As of this commit,
we currently use the authorization_endpoint and token_endpoint fields.
To check and see if their third-party server implements RFC8414, they can go
to <server host>/.well-known/oauth-authorization-server.

Prominent third-party OpenStreetMap servers may give us a client id for their
specific server. That client id may be added to the hard-coded client id list
at maintainer discretion. At a minimum, the server must be publicly
available and have a significant user base.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/test/unit/org/openstreetmap/josm/gui/io/DownloadOpenChangesetsTaskTest.java

    r18870 r18991  
    99import java.awt.GraphicsEnvironment;
    1010import java.net.URL;
    11 import java.util.Collections;
     11import java.util.HashMap;
     12import java.util.Map;
    1213
    1314import javax.swing.JOptionPane;
    1415import javax.swing.JPanel;
    1516
    16 import org.junit.jupiter.api.BeforeEach;
    1717import org.junit.jupiter.api.Test;
    1818import org.openstreetmap.josm.TestUtils;
    1919import org.openstreetmap.josm.data.UserIdentityManager;
    2020import org.openstreetmap.josm.gui.oauth.OAuthAuthorizationWizard;
    21 import org.openstreetmap.josm.spi.preferences.Config;
    2221import org.openstreetmap.josm.testutils.annotations.BasicPreferences;
    2322import org.openstreetmap.josm.testutils.annotations.OsmApi;
    … …  
    6463
    6564    /**
    66      * These tests were written with {@link org.openstreetmap.josm.data.oauth.OAuthVersion#OAuth10a} as the default auth method.
    67      */
    68     @BeforeEach
    69     void setup() {
    70         Config.getPref().put("osm-server.auth-method", "oauth");
    71     }
    72 
    73     /**
    7465     * Test of {@link DownloadOpenChangesetsTask} class when anonymous.
    7566     */
    … …  
    8071            new WindowMocker();
    8172        }
    82         final OAuthWizardMocker oaWizardMocker = new OAuthWizardMocker();
    83         final JOptionPaneSimpleMocker jopsMocker = new JOptionPaneSimpleMocker(
    84             Collections.singletonMap(
    85                 "<html>Could not retrieve the list of your open changesets because<br>JOSM does not know "
     73        final Map<String, Object> optionPaneMock = new HashMap<>(2);
     74        optionPaneMock.put("<html>Could not retrieve the list of your open changesets because<br>JOSM does not know "
    8675                + "your identity.<br>You have either chosen to work anonymously or you are not "
    87                 + "entitled<br>to know the identity of the user on whose behalf you are working.</html>", JOptionPane.OK_OPTION
    88             )
    89         );
     76                + "entitled<br>to know the identity of the user on whose behalf you are working.</html>", JOptionPane.OK_OPTION);
     77        optionPaneMock.put("Obtain OAuth 2.0 token for authentication?", JOptionPane.NO_OPTION);
     78        final JOptionPaneSimpleMocker jopsMocker = new JOptionPaneSimpleMocker(optionPaneMock);
    9079
    9180        DownloadOpenChangesetsTask task = new DownloadOpenChangesetsTask(new JPanel());
    … …  
    9685        assertNull(task.getChangesets());
    9786
    98         assertEquals(1, jopsMocker.getInvocationLog().size());
    99         Object[] invocationLogEntry = jopsMocker.getInvocationLog().get(0);
     87        assertEquals(2, jopsMocker.getInvocationLog().size());
     88        Object[] invocationLogEntry = jopsMocker.getInvocationLog().get(1);
    10089        assertEquals(JOptionPane.OK_OPTION, (int) invocationLogEntry[0]);
    10190        assertEquals("Missing user identity", invocationLogEntry[2]);
    10291
    103         assertTrue(oaWizardMocker.called);
     92        invocationLogEntry = jopsMocker.getInvocationLog().get(0);
     93        assertEquals(JOptionPane.NO_OPTION, (int) invocationLogEntry[0]);
     94        assertEquals("Obtain authentication to OSM servers", invocationLogEntry[2]);
    10495    }
    10596
    … …  
    113104            new WindowMocker();
    114105        }
    115         final OAuthWizardMocker oaWizardMocker = new OAuthWizardMocker();
    116         final JOptionPaneSimpleMocker jopsMocker = new JOptionPaneSimpleMocker(
    117             Collections.singletonMap("There are no open changesets", JOptionPane.OK_OPTION)
    118         );
     106        final Map<String, Object> optionPaneMock = new HashMap<>(2);
     107        optionPaneMock.put("There are no open changesets", JOptionPane.OK_OPTION);
     108        optionPaneMock.put("Obtain OAuth 2.0 token for authentication?", JOptionPane.NO_OPTION);
     109        final JOptionPaneSimpleMocker jopsMocker = new JOptionPaneSimpleMocker(optionPaneMock);
    119110
    120111        DownloadOpenChangesetsTask task = new DownloadOpenChangesetsTask(new JPanel());
    … …  
    124115        assertNotNull(task.getChangesets());
    125116
    126         assertEquals(1, jopsMocker.getInvocationLog().size());
    127         Object[] invocationLogEntry = jopsMocker.getInvocationLog().get(0);
     117        assertEquals(2, jopsMocker.getInvocationLog().size());
     118        Object[] invocationLogEntry = jopsMocker.getInvocationLog().get(1);
    128119        assertEquals(JOptionPane.OK_OPTION, (int) invocationLogEntry[0]);
    129120        assertEquals("No open changesets", invocationLogEntry[2]);
    130121
    131         assertTrue(oaWizardMocker.called);
     122        invocationLogEntry = jopsMocker.getInvocationLog().get(0);
     123        assertEquals(JOptionPane.NO_OPTION, (int) invocationLogEntry[0]);
     124        assertEquals("Obtain authentication to OSM servers", invocationLogEntry[2]);
    132125    }
    133126}
Note: See TracChangeset for help on using the changeset viewer.