source: josm/trunk/src/org/openstreetmap/josm/data/oauth/OAuthParameters.java

Last change on this file was 19008, checked in by taylor.smock, 7 weeks ago

Fix an issue with custom OAuth2 parameters where the custom parameters would be replaced by default parameters
  • Property svn:eol-style set to native
File size: 9.6 KB
Line 
1// License: GPL. For details, see LICENSE file.
2package org.openstreetmap.josm.data.oauth;
3
4import java.io.BufferedReader;
5import java.io.IOException;
6import java.net.URI;
7import java.net.URISyntaxException;
8import java.net.URL;
9import java.util.HashMap;
10import java.util.Map;
11
12import org.openstreetmap.josm.io.NetworkManager;
13import org.openstreetmap.josm.io.OsmApi;
14import org.openstreetmap.josm.io.auth.CredentialsAgentException;
15import org.openstreetmap.josm.io.auth.CredentialsManager;
16import org.openstreetmap.josm.spi.preferences.Config;
17import org.openstreetmap.josm.spi.preferences.IUrls;
18import org.openstreetmap.josm.tools.HttpClient;
19import org.openstreetmap.josm.tools.JosmRuntimeException;
20import org.openstreetmap.josm.tools.Logging;
21import org.openstreetmap.josm.tools.Utils;
22
23import jakarta.json.Json;
24import jakarta.json.JsonObject;
25import jakarta.json.JsonReader;
26import jakarta.json.JsonStructure;
27import jakarta.json.JsonValue;
28
29/**
30 * This class manages an immutable set of OAuth parameters.
31 * @since 2747 (static factory class since 18991)
32 */
33public final class OAuthParameters {
34 private static final Map<String, JsonObject> RFC8414_RESPONSES = new HashMap<>(1);
35 private static final String OSM_API_DEFAULT = "https://api.openstreetmap.org/api";
36 private static final String OSM_API_DEV = "https://api06.dev.openstreetmap.org/api";
37 private static final String OSM_API_MASTER = "https://master.apis.dev.openstreetmap.org/api";
38
39 private OAuthParameters() {
40 // Hide constructor
41 }
42
43 /**
44 * Replies a set of default parameters for a consumer accessing the standard OSM server
45 * at {@link IUrls#getDefaultOsmApiUrl}.
46 * <p>
47 * Note that this may make network requests for RFC 8414 compliant endpoints.
48 * @return a set of default parameters
49 */
50 public static IOAuthParameters createDefault() {
51 return createDefault(Config.getUrls().getDefaultOsmApiUrl(), OAuthVersion.OAuth20);
52 }
53
54 /**
55 * Replies a set of default parameters for a consumer accessing an OSM server
56 * at the given API url. URL parameters are only set if the URL equals {@link IUrls#getDefaultOsmApiUrl}
57 * or references the domain "dev.openstreetmap.org", otherwise they may be <code>null</code>.
58 * <p>
59 * Note that this may make network requests for RFC 8414 compliant endpoints.
60 *
61 * @param apiUrl The API URL for which the OAuth default parameters are created. If null or empty, the default OSM API url is used.
62 * @param oAuthVersion The OAuth version to create default parameters for
63 * @return a set of default parameters for the given {@code apiUrl}
64 * @since 18650
65 */
66 public static IOAuthParameters createDefault(String apiUrl, OAuthVersion oAuthVersion) {
67 if (!Utils.isValidUrl(apiUrl)) {
68 apiUrl = null;
69 }
70
71 switch (oAuthVersion) {
72 case OAuth20:
73 case OAuth21: // For now, OAuth 2.1 (draft) is just OAuth 2.0 with mandatory extensions, which we implement.
74 return getDefaultOAuth20Parameters(apiUrl);
75 default:
76 throw new IllegalArgumentException("Unknown OAuth version: " + oAuthVersion);
77 }
78 }
79
80 private static JsonObject getRFC8414Parameters(String apiUrl) {
81 HttpClient client = null;
82 try {
83 final URI apiURI = new URI(apiUrl);
84 final URL rfc8414URL = new URI(apiURI.getScheme(), apiURI.getHost(),
85 "/.well-known/oauth-authorization-server", null).toURL();
86 client = HttpClient.create(rfc8414URL);
87 HttpClient.Response response = client.connect();
88 if (response.getResponseCode() == 200) {
89 try (BufferedReader reader = response.getContentReader();
90 JsonReader jsonReader = Json.createReader(reader)) {
91 JsonStructure structure = jsonReader.read();
92 if (structure.getValueType() == JsonValue.ValueType.OBJECT) {
93 return structure.asJsonObject();
94 }
95 }
96 }
97 } catch (URISyntaxException | IOException e) {
98 throw new JosmRuntimeException(e);
99 } finally {
100 if (client != null) {
101 client.disconnect();
102 }
103 }
104 return Json.createObjectBuilder().build();
105 }
106
107 /**
108 * Get the default OAuth 2.0 parameters
109 * @param apiUrl The API url
110 * @return The default parameters
111 */
112 private static OAuth20Parameters getDefaultOAuth20Parameters(String apiUrl) {
113 final String clientId;
114 final String clientSecret;
115 final String redirectUri = "http://127.0.0.1:8111/oauth_authorization";
116 final String baseUrl;
117 apiUrl = apiUrl == null ? OsmApi.getOsmApi().getServerUrl() : apiUrl;
118 switch (apiUrl) {
119 case OSM_API_DEV:
120 case OSM_API_MASTER:
121 // This clientId/clientSecret are provided by taylor.smock. Feel free to change if needed, but
122 // do let one of the maintainers with server access know so that they can update the test OAuth
123 // token.
124 clientId = "-QZt6n1btDfqrfJNGUIMZjzcyqTgIV6sy79_W4kmQLM";
125 // Keep secret for dev apis, just in case we want to test something that needs it.
126 clientSecret = "SWnmRD4AdLO-2-ttHE5TR3eLF2McNf7dh0_Z2WNzJdI";
127 break;
128 case OSM_API_DEFAULT:
129 clientId = "edPII614Lm0_0zEpc_QzEltA9BUll93-Y-ugRQUoHMI";
130 // We don't actually use the client secret in our authorization flow.
131 clientSecret = null;
132 break;
133 case "https://www.openhistoricalmap.org/api":
134 // clientId provided by 1ec5 (Minh Nguyễn)
135 clientId = "Hl5yIhFS-Egj6aY7A35ouLOuZl0EHjj8JJQQ46IO96E";
136 clientSecret = null;
137 break;
138 default:
139 clientId = "";
140 clientSecret = null;
141 }
142 baseUrl = apiUrl;
143 // Check if the server is RFC 8414 compliant
144 try {
145 synchronized (RFC8414_RESPONSES) {
146 final JsonObject data;
147 if (NetworkManager.isOffline(apiUrl)) {
148 data = null;
149 } else {
150 data = RFC8414_RESPONSES.computeIfAbsent(apiUrl, OAuthParameters::getRFC8414Parameters);
151 }
152 if (data == null || data.isEmpty()) {
153 RFC8414_RESPONSES.remove(apiUrl);
154 } else {
155 return parseAuthorizationServerMetadataResponse(clientId, clientSecret, apiUrl,
156 redirectUri, data);
157 }
158 }
159 } catch (JosmRuntimeException e) {
160 if (e.getCause() instanceof URISyntaxException || e.getCause() instanceof IOException) {
161 Logging.trace(e);
162 } else {
163 throw e;
164 }
165 } catch (OAuthException e) {
166 Logging.trace(e);
167 }
168 // Fall back to guessing the parameters.
169 return new OAuth20Parameters(clientId, clientSecret, baseUrl, apiUrl, redirectUri);
170 }
171
172 /**
173 * Parse the response from <a href="https://www.rfc-editor.org/rfc/rfc8414.html">RFC 8414</a>
174 * (OAuth 2.0 Authorization Server Metadata)
175 * @return The parameters for the server metadata
176 */
177 private static OAuth20Parameters parseAuthorizationServerMetadataResponse(String clientId, String clientSecret,
178 String apiUrl, String redirectUri,
179 JsonObject serverMetadata)
180 throws OAuthException {
181 final String authorizationEndpoint = serverMetadata.getString("authorization_endpoint", null);
182 final String tokenEndpoint = serverMetadata.getString("token_endpoint", null);
183 // This may also have additional documentation like what the endpoints allow (e.g. scopes, algorithms, etc.)
184 if (authorizationEndpoint == null || tokenEndpoint == null) {
185 throw new OAuth20Exception("Either token endpoint or authorization endpoints are missing");
186 }
187 return new OAuth20Parameters(clientId, clientSecret, tokenEndpoint, authorizationEndpoint, apiUrl, redirectUri);
188 }
189
190 /**
191 * Replies a set of parameters as defined in the preferences.
192 *
193 * @param oAuthVersion The OAuth version to use.
194 * @param apiUrl the API URL. Must not be {@code null}.
195 * @return the parameters
196 * @since 18650
197 */
198 public static IOAuthParameters createFromApiUrl(String apiUrl, OAuthVersion oAuthVersion) {
199 // We actually need the host
200 if (apiUrl.startsWith("https://") || apiUrl.startsWith("http://")) {
201 try {
202 apiUrl = new URI(apiUrl).getHost();
203 } catch (URISyntaxException syntaxException) {
204 Logging.trace(apiUrl);
205 }
206 }
207 switch (oAuthVersion) {
208 case OAuth20:
209 case OAuth21: // Right now, OAuth 2.1 will work with our OAuth 2.0 implementation
210 try {
211 IOAuthToken storedToken = CredentialsManager.getInstance().lookupOAuthAccessToken(apiUrl);
212 if (storedToken != null) {
213 return storedToken.getParameters();
214 }
215 } catch (CredentialsAgentException e) {
216 Logging.trace(e);
217 }
218 return createDefault(apiUrl, oAuthVersion);
219 default:
220 throw new IllegalArgumentException("Unknown OAuth version: " + oAuthVersion);
221 }
222 }
223}
Note: See TracBrowser for help on using the repository browser.