Changes between Version 46 and Version 47 of Help/Preferences/Connection

Timestamp:

2023-09-26T18:44:43+02:00 (2 years ago)

Author:

taylor.smock

Comment:

Add OAuth 2 section

Help/Preferences/Connection

@@ -50 +50 @@
 Here's a screenshot of the preferences panel for basic authentication: 
 
-[[Image(basic-authentication.png,link=)]]
+[[Image(basic-authentication.2.png,link=)]]
 
 To use Basic Authentication
@@ -58 +58 @@
 1. Enter your OSM username and your OSM password 
 
-=== OAuth based authentication ===
-[https://oauth.net/ OAuth] is an open protocol to allow secure API authorization  in a simple and standard method from desktop and web applications. The OSM server supports OAuth in addition to basic authentication.
+=== OAuth 1.0a based authentication ===
+**OAuth 1.0a is deprecated. Please use OAuth 2.0 or later instead!**
+
+[https://oauth.net/1 OAuth 1.0a] is an open protocol to allow secure API authorization in a simple and standard method from desktop and web applications. The OSM server supports OAuth in addition to basic authentication.
 
 OAuth has two major advantages over basic authentication:
@@ -76 +78 @@
 * Selecting the checkbox "Display advanced OAuth parameters" to get the [wikitr:/Help/Dialog/OAuthAuthorisationWizard#AdvancedOAuthparameters advanced OAuth parameters] displayed.
 
+=== OAuth 2.0 based authentication ===#oauth2
+[https://oauth.net/2 OAuth 2.0] is an open protocol to allow secure API authorization in a simple and standard method from desktop and web applications. The OSM server supports OAuth 2.0 in addition to basic authentication.
+
+OAuth has two major advantages over basic authentication:
+1. Your OSM password doesn't have to be saved in clear text in the JOSM preferences file.
+1. Your OSM password has to be transferred encrypted **only once** over the Internet, in contrast to basic authentication where your OSM password is transferred unencrypted as part of every request sent from JOSM to the OSM server. 
+
+OAuth 2.0 uses [wikitr:RemoteControl Remote Control] to receive the token from the OAuth server. If you have issues authenticating, you can disable remote control in other running instances of JOSM and disable ''then'' re-enable it in the JOSM instance you are trying to authenticate.
+
+Once initialized the access token is represented with the following options:
+
+[[Image(oauth-2-authentication.png,500,link=)]]
+
+* Deselect the checkbox **Save to preferences** if you don't want to save the Access Token in the JOSM preferences. If you don't save it the Access Token will be lost when you close JOSM. If you later startup JOSM again you will have to retrieve a new Access Token to work with OAuth based authentication again.
+* Click on **Test Access Token** to submit a test request with the token to the OSM server. JOSM will analyze whether this token is authorized to access the OSM server.
+* Click on **Remove token** to remove the current token. The `Authorise now` button will reappear.
 
 == New OSM account messages ==