Changes between Version 3 and Version 4 of Ru:Help/Dialog/OAuthAuthorisationWizard


Ignore:
Timestamp:
2017-11-15T11:42:09+01:00 (8 years ago)
Author:
ak099
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • Ru:Help/Dialog/OAuthAuthorisationWizard

    v3 v4  
    1 [[TranslatedPages(revision=20)]]
     1[[TranslatedPages(revision=33,outdated=Перевод пока не завершён)]]
    22= Мастер авторизации OAuth =
    3 [[TOC(inline)]]
     3[[PageOutline(2-10,Содержание)]]
    44
    5 == OAuth in a nutshell ==
    6 [http://oauth.net/ OAuth] is an open protocol to allow secure API authorization  in a simple and standard method from desktop and web applications.
     5== Что такое OAuth ==
     6[http://oauth.net/ OAuth] — это открытый протокол, обеспечивающий API для безопасной авторизации простым и стандартным методом как с персонального компьютера, так и из веб-приложений.
    77
    8 === Standard use case - keep your OSM password private ===
    9 The standard use case in OSM for OAuth is to keep your OSM password more private than with Basic Authentication.
     8=== Стандартный случай использования — безопасное хранение вашего пароля OSM ===
     9Стандартное использование OAuth в OSM — для хранения вашего пароля к OSM более защищённым, чем при обычной аутентификации.
    1010
    11 OAuth has two major advantages over Basic Authentication:
    12   1. Your OSM password doesn't have to be saved in clear text in the JOSM preferences file.
    13   2. Your OSM password has to be transferred '''only once''' over the Internet, in contrast to basic authentication where your OSM password is trasferred as part of every request sent from JOSM to the OSM server.
     11OAuth имеет два больших преимущества по сравнению с обычной аутентификацией:
     12 1. Пароль к OSM не хранится в виде открытого текста в файле настроек JOSM.
     13 1. Ваш пароль передаётся через Интернет '''только один раз''' через '''защищённое соединение''', в то время, как при обычной аутентификации пароль передаётся открытым текстом как часть каждого запроса из JOSM к серверу OSM.
    1414
    15 {{{
    16 #!html
    17 <p style="background-color:rgb(253,255,221);padding: 10pt; border-color:rgb(128,128,128);border-style: solid; border-width: 1px;">
    18 <strong>Warning!</strong><br/>
    19 Currently, the OSM server doesn't offer a secure communication channel. Even if you use OAuth your password is therefore transferred <strong>once in clear text</strong> over the Internet. <strong>Do not use a valuable password</strong> until the OSM server provides a secure communication channel (HTTPS).
    20 </p>
    21 }}}
     15В терминологии OAuth, пользователь JOSM авторизует (санкционирует) JOSM получать доступ к серверу OSM в интересах пользователя. Во время процесса авторизации пароль OSM не нужно вводить в диалоговом окне JOSM, если пользователь не полностью доверяет JOSM (разве что из соображений удобства [wiki:/Ru:Help/Dialog/OAuthAuthorisationWizard#FullyAutomaticAuthorisation см. здесь]). Вместо этого, сервер OSM выпускает маркер доступа (токен), который JOSM будет предъявлять серверу OSM при отправке данных. Маркер доступа не раскрывает пароль пользователя и его можно отозвать в любое время.
    2216
    23 In OAuth terminology, a JOSM user authorises JOSM to access the OSM server on his behalf. During the authorisation process he never has to enter his OSM password into a JOSM dialog if he or she doesn't fully trust JOSM (unless he wants to for convenience reasons [wiki:/Help/Dialog/OAuthAuthorisationWizard#FullyAutomaticAuthorisation see here]). Rather, the OSM server issues an Access Token which JOSM presents to the OSM server when it uploads data on behalf of the user. Access Tokens don't reveal the users password and they can be revoked at any time.
     17=== Более сложный случай использования — делегирование доступа другим картографам ===
     18Более сложное использование OAuth — для делегирования доступа к вашей учетной записи в OSM другим пользователям. OAuth позволяет при необходимости предоставлять другому пользователю ограниченный доступ к вашему аккаунту.
    2419
    25 === Advanced use case - delegate access to other mappers ===
    26 A more advanced use case for OAuth is to delegate access to your OSM account to other mappers. OAuth allows you to grant another user restricted access to your account if necessary.
    27 
    28 Example: Mapper A can grant mapper B the right to download its private GPS traces from the OSM website. Mapper A would generate an OAuth Access Token and restrict to the privilege "Download my private GPS traces". He would then send an email with the Access Token to mapper B. B can enter the Access Token in JOSM and he is now allowed to download A's private GPS traces from the OSM server. He wouldn't be allowed to upload date on A's behalf, though, and he doesn't know A's OSM password. At any time, A can revoke the Access Token issued for B.
     20Пример: картограф A может доверить картографу Б право скачивать его приватные GPS-треки с веб-сайта OSM. Картограф A генерирует маркер доступа OAuth и ограничивает его права до  "Разрешить загружать свои GPS-треки". Затем он отправляет по электронной почте свой маркер картографу Б. Тот вводит маркер доступа в JOSM и после этого получает право скачивать приватные треки картографа A с сервера OSM. Но он не может отправлять данные от имени A и не знает его пароль к OSM. В любое время A может отозвать (аннулировать) маркер доступа, выпущенный для Б.
    2921
    3022
    31 == The OAuth Authorisation Wizard ==
     23== Мастер авторизации OAuth ==
     24Мастер авторизации Oauth расположен в секции [Preferences/Connection Параметры соединения] настроек JOSM.
    3225
    33 === What does authentication/authorization mean? ===
    34 When you upload geodata to the OSM server you have to tell the server who you are. The OSM server asks every uploading mapper to '''identify''' himself with an OSM username. The OSM server furthermore needs to '''authenticate''' this identity, i.e. to reliably determine whether the mapper is indeed who he or she claims to be. For this purpose, it asks for a password in addition to the username. The servers assumption is, that whoever knows the secret password for username xyz is reliably authenticated to ''be'' xyz. A mapper logging in with his username and password is entitled to run a broad range of operations on the server. He or she is '''authorised''' to upload data, to create changesets, to close changesets, to upload GPS traces, to read and changes personal preferences on the server, to invite others as friends, to send emails to other accounts, etc. Currently, it isn't possible to create an OSM account with an OSM username and a password with restricted rights, i.e. an account which would only be able to upload GPS traces, but not map data. Whoever has successfully '''authenticated''' with an OSM username and an OSM password is '''fully authorised''' to do everything an OSM user can do on the server.
     26=== Что означает аутентификация/авторизация? ===
     27Когда вы отправляете геоданные на сервер OSM, вы сообщаете серверу, кто вы такой. Сервер OSM '''идентифицирует''' каждого присылающего данные картографа, запрашивая его имя пользователя OSM. Затем серверу OSM необходимо '''аутентифицировать''' его личность, т.е. надёжно определить — тот ли он, за кого себя выдаёт. Для этой цели он запрашивает пароль в дополнение к имени пользователя. Сервер подразумевает, что тот, кто знает секретный пароль для имени пользователя xyz — ''это и есть'' xyz. Картографу, вошедшему с аутентифицированным именем пользователя и паролем, предоставляются весьма широкий круг действий на сервере. Ему '''авторизовано''' право присылать данные, создавать пакеты правок, закрывать пакеты правок, присылать GPS-треки, читать и изменять персональные настройки на сервере, приглашать других людей в качестве друзей, отправлять почтовые сообщения другим учётным записям, и т.п. В настоящее время невозможно создать учётную запись OSM с именем пользователя и паролем, права которой были бы ограниченными, например, чтобы пользователь мог только загружать GPS-треки, но не отправлять данные. Тот, кто успешно '''аутентифицировался''', указав имя пользователя и пароль OSM, тот '''полностью авторизован''' выполнять любые доступные любому пользователю OSM действия на сервере.
    3528
    36 This is where OAuth comes into play: OAuth allows you to '''authorise''' somebody else to act in a restricted way on your behalf. Instead of giving away your OSM username and your OSM password, which would fully entitle the recipient to act on your behalf at the OSM server, you only give away a "ticket" on which the granted rights are listed. This ticket is called an '''Access Token'''. Restrictions applied to an Access Token include:
    37   * an Access Token is only valid for a specific client (called a Consumer in OAuth terminology), i.e. only for JOSM, but not for OpenStreetBugs
    38   * an Access Token is only valid for specific operations, i.e. only for uploading GPS traces, but not for uploading map data
    39   * an Access Token could only be valid for a certain time, i.e. only today, but this is not yet supported by the OSM server
     29Именно здесь вступает в игру OAuth: OAuth позволяет вам '''авторизовать''' кого-то ещё для выполнения ограниченного круга действий в ваших интересах. Вместо разглашения вашего имени пользователя и пароля OSM, которые бы позволили выполнять их получателю любые действия на сервер OSM, вы просто выдаёте ему «билет», на котором перечислены предоставляемые права. Этот «билет» и называется '''маркером доступа'''. К маркеру доступа применимы следующие ограничения:
     30  * маркер действителен лишь для определённого клиента (в терминологии OAuth — потребителя (consumer)), т.е. только для JOSM, а не для OpenStreetBugs
     31  * маркер действителен лишь для определённых операций, например, только для отправки GPS-треков, но не для отправки картографических данных
     32  * маркер действует лишь в течение определённого периода времени, например, только сегодня (но это пока не поддерживается сервером OSM)
    4033
    4134In addition to username/password pairs, the OSM server also accepts OAuth Access Tokens to authenticate and authorise a user. More specifically, it accepts requests ''signed with such a token'', but this is beyond of the scope of this online help.
    4235
    43 The OAuth Authorisation Wizard supports you to receive a valid OAuth Access Token, provided that you have an OSM username and an OSM password, or to enter and use an OAuth Access Token in JOSM, provided that you got one from somebody else who has an OSM username and an OSM password.
     36The OAuth Authorisation Wizard allows you to receive a valid OAuth Access Token, provided that you have an OSM username and OSM password, or to enter and use an OAuth Access Token in JOSM, provided that you got one from somebody else who has an OSM username and an OSM password.
    4437
    45 === Fully automatic authorization process ===
     38=== Fully automatic authorisation process ===#FullyAutomaticAuthorisation
    4639The easiest way to get an Access Token is to let JOSM fully automatically retrieve one from the OSM server.
    4740
    48  1. '''Step 1/2'''  - Get the Access Token
     411. '''Step 1/3'''  - Open the preferences dialog
    4942
    50     Enter your OSM username and your OSM password and click on '''Authorise now'''.
     43    Click on the '''Preferences''' button in the toolbar. In the dialog, select the [wiki:Help/Preferences/Connection Connection Setting] tab.
     44
     452. '''Step 2/3'''  - Get the Access Token
     46
     47 Enter your OSM username and your OSM password and click on '''Authorise now'''.
    5148   
    52     [[Image(Help/Dialog/OAuthAuthorisationWizard:fully-authomatic-1.png)]]
     49 [[Image(fully-authomatic-1.png)]]
    5350
    54  2. '''Step 2/2''' - Accept the Access Token
     513. '''Step 3/3''' - Accept the Access Token
    5552
    56     JOSM displays the retrieved Access Token. Click on '''Accept Access Token''' to accept it.
     53 JOSM displays the retrieved Access Token.
    5754   
    58     [[Image(Help/Dialog/OAuthAuthorisationWizard:fully-authomatic-2.png)]]
     55 [[Image(fully-authomatic-2.png)]]
     56
     57* Deselect the checkbox Save to preferences if you don't want to save the Access Token in the JOSM preferences. If you don't save it the Access Token will be lost when you close JOSM. If you later startup JOSM again you will have to retrieve a new Access Token to work with OAuth based authentication again.
     58* Click on ''Test Access Token" to test the token
     59* Click on '''Accept Access Token''' to accept it.
    5960
    6061==== Restricting the granted privileges ====
    6162When JOSM fully-automatically requests and authorises an Access Token, it grants it five privileges:
    62   * the right to upload data to the OSM server
    63   * the right to upload GPS traces to the OSM server
    64   * the right to download private GPS traces from the OSM server
    65   * the right to read the preferences stored on the OSM server
    66   * the right to write preferences stored on the OSM server
     63* the right to upload data to the OSM server
     64* the right to upload GPS traces to the OSM server
     65* the right to download private GPS traces from the OSM server
     66* the right to read the preferences stored on the OSM server
     67* the right to write preferences stored on the OSM server
    6768
    68 These are the default settings. If you want to restrict the granted privileges
     69These are the default settings. If you want to restrict the granted privileges:
    6970
    70   1. Click the tab '''Granted rights'''
    71   2. Deselect each privilege which should not be granted to the requested Access Token
     711. Click the tab '''Granted rights'''
     721. Deselect each privilege which should not be granted to the requested Access Token
    7273
    73     [[Image(Help/Dialog/OAuthAuthorisationWizard:fully-authomatic-privileges.png)]]
     74[[Image(fully-authomatic-privileges.png)]]
    7475
    7576==== Advanced OAuth parameters ==== #FullyAutomaticAdvanced
    76 When JOSM fully-automatically requests and authorises an Access Token, it uses default values for the OAuth parameters. Advanced users may want to change these parameters
    77  * in order to use a different Consumer Token (consisting of a Consumer Key and a Consumer Secret). This allows you to create your own Consumer Token for JOSM and then use it in JOSM.
    78  * in order to use it on a different than the standard OSM server. For instance, this allows users to use OAuth with a OSM development server or with a local installation of the OSM server application.
     77When JOSM fully-automatically requests and authorises an [https://oauth.net/core/1.0/#anchor3 Access Token], it uses default values for the OAuth parameters. Advanced users may want to change these parameters
     78* in order to use a different Consumer Token (consisting of a Consumer Key and a Consumer Secret). This allows you to create your own Consumer Token for JOSM and then use it in JOSM.
     79* in order to use it on a different than the standard OSM server. For instance, this allows users to use OAuth with an OSM development server or with a local installation of the OSM server application.
    7980
    8081In order to edit the Advanced OAuth parameters
    8182
    82   1. Click the tab '''Advanced OAuth parameters'''
    83   2. Deselect the checkbox '''Use default settings'''
    84   3. Enter your values for the five OAuth parameters
     83 1. Click the tab '''Advanced OAuth parameters'''
     84 1. Deselect the checkbox '''Use default settings'''
     85 1. Enter your values for the five OAuth parameters
    8586
    86       [[Image(Help/Dialog/OAuthAuthorisationWizard:fully-automatic-advanced.png)]]
     87[[Image(fully-automatic-advanced.png)]]
    8788
    88 === Semi-automatic authorization process ===
    89 You can also retrieve an Access Token semi-automatically. If you use this process you have to use both dialogs in JOSM and the OSM website launched in an external browser to create and authorise the Access Token. In contrast to the fully automatic process you never have to enter your OSM username or your OSM password into a JOSM dialog. This process is therefore suitable for user which - for whatever reason - never want to use their OSM password outside of the OSM website. Note however, that the semi-automatic process is '''not''' significantely more secure  than the fully automatic process. Your OSM password will be transferred in cleartext over the Internet, too, because the OSM website currently doesn't provide a login page protected by HTTPS. The fully automatic process runs exactly the same steps you run manually in the semi-automatic process, just without your intervention.
     89=== Semi-automatic authorisation process ===#Semi-automaticauthorisationprocess
     90You can also retrieve an Access Token semi-automatically. If you use this process you have to use both dialogs in JOSM and the OSM website launched in an external browser to create and authorise the Access Token. In contrast to the fully automatic process you never have to enter your OSM username or your OSM password into a JOSM dialog. This process is therefore suitable for a user which - for whatever reason - never wants to use their OSM password outside of the secure login page of the OSM website. The fully automatic process runs exactly the same steps that would run manually in the semi-automatic process, just without your intervention.
    9091
    9192
    92  1. '''Step 1/3'''  - Get the Request Token
     931. '''Step 1/3''' - Get the Request Token
    9394
    94    Click on '''Retrieve Request Token''' to retrieve an OAuth Request Token.
     95 Click on '''Retrieve Request Token''' to retrieve an OAuth Request Token.
    9596   
    96     [[Image(Help/Dialog/OAuthAuthorisationWizard:semi-automatic-step-1.png)]]
     97 [[Image(semi-automatic-step-1.png)]]
    9798
    98  2. '''Step 2/3''' - Authorise the Request Token in an external browser
     992. '''Step 2/3''' - Authorise the Request Token in an external browser
    99100
    100     JOSM now launches an external browser with the OSM website. Please login and follow the instructions. Then switch back to the OAuth Authorisation Wizard and click on '''Retrieve Access Token'''.
     101 JOSM now launches an external browser with the OSM website. Please login and follow the instructions. Then switch back to the OAuth Authorisation Wizard and click on '''Retrieve Access Token'''.
    101102   
    102     [[Image(Help/Dialog/OAuthAuthorisationWizard:semi-automatic-step-2.png)]]
     103 [[Image(semi-automatic-step-2.png)]]
    103104
    104  2. '''Step 3/3''' - Accept the Access Token
     1053. '''Step 3/3''' - Accept the Access Token
    105106
    106     JOSM displays the retrieved Access Token. Click on '''Accept Access Token''' to accept it.
     107 JOSM displays the retrieved Access Token. Click on '''Accept Access Token''' to accept it.
    107108   
    108     [[Image(Help/Dialog/OAuthAuthorisationWizard:semi-automatic-step-3.png)]]
     109 [[Image(semi-automatic-step-3.png)]]
    109110
    110111
    111 ==== Advanced OAuth parameters ====
     112==== Advanced OAuth parameters ==== #AdvancedOAuthparameters
    112113When JOSM semi-automatically requests and authorises an Access Token, it uses default values for the OAuth parameters. Advanced users may want to change these parameters
    113  * in order to use a different Consumer Token (consisting of a Consumer Key and a Consumer Secret). This allows you to create your own Consumer Token for JOSM and then use it in JOSM.
    114  * in order to use it on a different than the standard OSM server. For instance, this allows users to use OAuth with a OSM development server or with a local installation of the OSM server application.
     114* in order to use a different Consumer Token (consisting of a Consumer Key and a Consumer Secret). This allows you to create your own Consumer Token for JOSM and then use it in JOSM.
     115* in order to use it on a different than the standard OSM server. For instance, this allows users to use OAuth with an OSM development server or with a local installation of the OSM server application.
    115116
    116117In order to edit the Advanced OAuth parameters
    117118
    118   1. Select the checkbox '''Display Advanced OAuth Parameters'''
    119   2. Enter your values for the five OAuth parameters
     119 1. Select the checkbox '''Display Advanced OAuth Parameters'''
     120 1. Enter your values for the five OAuth parameters
    120121
    121   [[Image(Help/Dialog/OAuthAuthorisationWizard:semi-automatic-advanced.png)]]
     122[[Image(semi-automatic-advanced.png)]]
    122123
    123 === Manual authorization process ===
     124=== Manual authorisation process ===
    124125The manual authorisation process allows you to enter an arbitrary Access Token. You can use this process
    125126
    126   * to enter an Access Token you have kept in a secure place, for instance in a secure store for credentials
    127   * to enter an Access Token you have received from somebody else, for instance from another mapper who granted you restricted access to his OSM account
     127* to enter an Access Token you have kept in a secure place, for instance in a secure store for credentials
     128* to enter an Access Token you have received from somebody else, for instance from another mapper who granted you restricted account access
    128129
    129  1. '''Step 1/1'''  - Enter the Access Token and accept it
     1301. '''Step 1/1'''  - Enter the Access Token and accept it
    130131
    131    Enter the Access Token and click on '''Accept Access Token'''.
     132 Enter the Access Token and click on '''Accept Access Token'''.
    132133
    133   [[Image(Help/Dialog/OAuthAuthorisationWizard:manual.png)]]
     134 [[Image(manual.png)]]
    134135 
    135136
    136137==== Advanced OAuth parameters ====
    137  * See [wiki:/Help/Dialog/OAuthAuthorisationWizard#FullyAutomaticAdvanced advanced preferences in the fully automatic process].
     138* See [wiki:/Help/Dialog/OAuthAuthorisationWizard#FullyAutomaticAdvanced advanced preferences in the fully automatic process].
    138139
     140== Troubleshooting ==
     141* If you are working on a university or corporate network, a firewall may prevent the OAuth authentification request.[[BR]]
     142 Please check the corresponding connection with your network engineer.
     143----
     144Back to [wiki:/Help/Preferences/Connection Connection settings][[Br]]
     145Back to [wiki:Help Main Help]