Authentication doesn't seem to be working

[SomeoneElseOSM]

When I try and sign in to Potlatch3 it gets over the first hurdle but fails at the second:

(the credentials were copied from a password manager and worked in an incognito web browser, which should rule out my typing as a factor)

Is this perhaps related to the Oauth1 / 1.0a / 2 changes - https://lists.openstreetmap.org/pipermail/announce/2024-February/000116.html ?

[SomeoneElseOSM]

In the user profile under Oauth 1 settings I see:

[zstadler]

Same for me. It looks like the login was successful as I can see the private ("Trackable") GPS traces I've uploded

[systemed]

I presume this is a result of openstreetmap/chef@4d161f9.

I didn't write the original P2 OAuth code (or at least, not that I can remember!) and it doesn't seem sensible to try to retrofit 1.0a to it for the sake of a couple of months. Instead we should move to OAuth2 for which a library happily exists (https://github.com/charlesbihis/actionscript-oauth2). I'll try to get to that as soon as is possible.

[zstadler]

@systemed,
Please see what can be done about this issue.

[systemed]

Yep, I'm aware of it and when I get a spare moment I'll look at it, unless of course anyone beats me to it :)

[mmd-osm]

Linking to openstreetmap/operations#867 for tracking purposes only.

[BikePC]

I have a working Potlatch3 setup on my Windows 10 Home 64bit laptop. For testing and to try to get insight in the above issue I have made a fresh install of Windows 10 Home 64bit on my desktop test-PC. Running potlatch.exe 3 from the unpacked .zip distribution of 2022-01-24 after first logging in on openstreetmap.org with the same credentials as on my laptop I can do everything with Potlatch 3 except saving a changeset. The same screens and error appears as here above. If I check my settings and preferences in openstreetmap.org from both machines - the laptop and the desktop - they are identical, logically because they are online on the OSM server.
My conclusion so far is that somewhere locally on the PC settings are saved that do not meet the current OSM requirements.
Firewall settings maybe and there are settings in the registry regarding 'potlatch' which I don't understand? Have looked around in ProgramData and Appdata, but no potlatch stuff there.
When I restore the disk image with a working Potlatch om my desktop test-PC, overwriting the fresh Win10 install, everything is fine again. Proving that we have to search locally on the PC, is'nt it?

[systemed]

OpenStreetMap has started doing "brownouts" for OAuth 1 which is what Potlatch uses to authenticate. I'm planning to implement support for OAuth 2 but haven't had time to do so yet, and certainly won't do before this weekend at the very earliest. (It's rather more complex in ActionScript than in other languages because OAuth 2 wasn't a well supported standard at the time that ActionScript 3 was in wide usage.)

/cc @Firefishy

[SomeoneElseOSM]

For info, I also see "if you were previously authenticated, you can still use P3, but new authentications do not work". Logging out means that you won't be able to log in again. This has been the case since oauth1 was disabled.

This only applies if there is not currently a brownout; I did try yesterday when "basic / oauth1a" was was turned off. What happened was that a message appeared in the P3 window suggesting that some endpoint was unavailable; it didn't say anything about authentication and the message mentioned in https://community.openstreetmap.org/t/oauth-1-0a-and-http-basic-auth-shutdown/108490/17 did not appear.

[DaveF63]

It appears both 1.0 & 1.0a are turned off as of June 1st.

"A server error occurred. Do you want to retry? (The server said: OAuth 1.0 and 1.0a are disabled: https://wiki.openstreetmap.org/wiki/2024_authentication_update)".

Unable to save & there are no backgrounds available.

[systemed]

Yep... I'm working on this latest bout of security theatre at present.

[systemed]

The OAuth2 code is all done in #49.

However, some upgrade or other to AIR has broken text rendering for a very large part of the user interface:

Unfortunately we do need to use a recent version of AIR in order to show the HTML for osm.org's OAuth2 authentication screen.

The upshot is that I can't currently produce a workable build. I have managed to successfully get a local copy going by using a Heath Robinson amalgam of two separate AIR versions, but any .air file that's produced has the same text rendering issue.

I have posted over on the AIR repo to find out what can be done about this, but until then I can't move any further forward with this, exasperatingly.

[SomeoneElseOSM]

Thanks. Is there a downloadable build that I can try under something like wine? I've sure I've seen text problems like that before and seem to remember using various wine-level bodges to resolve.

[systemed]

I'm unable to build a Windows-native application at the moment so I don't think there'd be a lot of success running Wine.

Having retried with a completely fresh install on a modern Mac, I'm now pretty sure this is an AIR issue. The AIR developers are usually pretty responsive so I'm hopeful there'll be a fix soon.

If anyone wants to try building P3 themselves this is the process:

• install AIR
• install AIR SDK for Flex Developers: https://airsdk.harman.com/download
• download Apache Flex SDK: https://flex.apache.org/installer.html
• copy the Flex SDK files over the Air SDK (as per step 4 at https://helpx.adobe.com/uk/x-productkb/multi/how-overlay-air-sdk-flex-sdk.html) to produce a merged directory
• add /path/to/your/Flex/SDK/bin to your command line path, so it can find the compiler and launcher
• clone P3 and git checkout oauth2
• amxmlc potlatch2.mxml -debug=false -omit-trace-statements=false
• adl potlatch2-app.xml -nodebug

Edit: confirmed by another AIR user that this appears to be an issue with the latest AIR SDK.

[systemed]

Good news from Harman:

Fix should be out in the next release, next week...