<h3 dir="auto">Description</h3>
<p dir="auto">OSM <code class="notranslate">access_token</code> don't have expiry but <code class="notranslate">id_token</code> which is generated when <code class="notranslate">openid</code> scope is enabled has expiry of 2 minutes. Making <code class="notranslate">id_token</code> to also never expiry seems to me more problematic than no expiry for <code class="notranslate">access_token</code> because <code class="notranslate">id_token</code> can not be revoked, hence it is important to have short expiry. But with short expiry it makes <code class="notranslate">id_token</code> not very useful and it would complicate authentication against 3rd party services. Instead I think it is better to enable refresh token on OSM when <code class="notranslate">openid</code> scope is enabled for app which allows apps to refresh <code class="notranslate">id_token</code> by calling <code class="notranslate">/oauth/token</code> using refresh token. This way app can refresh <code class="notranslate">id_token</code> at any time and send it to 3rd party service which can authenticate user.</p>
<h3 dir="auto">How has this been tested?</h3>
<p dir="auto">Added unit tests, and manually on my machine, also verified that calling <code class="notranslate">/oauth/token</code> with refresh token works and produces fresh <code class="notranslate">id_token</code>.</p>
<h3 dir="auto">More details</h3>
<p dir="auto">My main goal on how to use this is following. Mobile app such as EveryDoor, StreetComplete... Can add <code class="notranslate">openid</code> to their OAuth Application scopes. That will result in getting <code class="notranslate">id_token</code> property in JSON of osm.org/oauth/token that can be passed to Panoramax as <code class="notranslate">Authorization Bearer jwt_token_that_osm.org/oauth/token_returned_in_id_token_field</code> when uploading photos. This will allow Panoramax API to use <a href="https://www.openstreetmap.org/oauth2/discovery/keys" rel="nofollow">https://www.openstreetmap.org/oauth2/discovery/keys</a> which has public key stored that can be used to verify the <code class="notranslate">id_token</code> and authenticate user. So from user perspective no additional logins or anything else needs to be done against Panoramax service. Another nice thing about sending OpenConnect ID token is that even if Panoramax service is compromised, this token is only useful to confirm this user did action, it does not give Panoramax any authorization to do anything against osm.org API.<br>
With this PR, mobile app will be able to fetch fresh <code class="notranslate">id_token</code> at any time and send it to Panoramax service which can authenticate user as long as whole operation takes less than 2 minutes which should be plenty.</p>
<hr>
<h4>You can view, comment on, or merge this pull request online at:</h4>
<p> <a href='https://github.com/openstreetmap/openstreetmap-website/pull/5497'>https://github.com/openstreetmap/openstreetmap-website/pull/5497</a></p>
<h4>Commit Summary</h4>
<ul>
<li><a href="https://github.com/openstreetmap/openstreetmap-website/pull/5497/commits/19fc51962e4c2a7767d0b6ee4b639c5f7d5d76dc" class="commit-link">19fc519</a> Add OAuth Refresh token when `openid` scope is used</li>
</ul>
<h4 style="display: inline-block">File Changes </h4> <p style="display: inline-block">(<a href="https://github.com/openstreetmap/openstreetmap-website/pull/5497/files">2 files</a>)</p>
<ul>
<li>
<strong>M</strong>
<a href="https://github.com/openstreetmap/openstreetmap-website/pull/5497/files#diff-c7fc4e057f18c41db72e3ab775f9871e6bee4d7e2b0aba1fdbfb2ea209dd2141">config/initializers/doorkeeper.rb</a>
(4)
</li>
<li>
<strong>M</strong>
<a href="https://github.com/openstreetmap/openstreetmap-website/pull/5497/files#diff-be2380df62967bf0c5853f681509cf5cd907dd105dcf2635b7047d5eac33f69f">test/integration/oauth2_test.rb</a>
(6)
</li>
</ul>
<h4>Patch Links:</h4>
<ul>
<li><a href='https://github.com/openstreetmap/openstreetmap-website/pull/5497.patch'>https://github.com/openstreetmap/openstreetmap-website/pull/5497.patch</a></li>
<li><a href='https://github.com/openstreetmap/openstreetmap-website/pull/5497.diff'>https://github.com/openstreetmap/openstreetmap-website/pull/5497.diff</a></li>
</ul>
<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br />Reply to this email directly, <a href="https://github.com/openstreetmap/openstreetmap-website/pull/5497">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AAK2OLKPGLL4NWCRMZ3EZKL2KTXQJAVCNFSM6AAAAABVEVGTUWVHI2DSMVQWIX3LMV43ASLTON2WKOZSG44DMOBYGY3TCMI">unsubscribe</a>.<br />You are receiving this because you are subscribed to this thread.<img src="https://github.com/notifications/beacon/AAK2OLPNRWOHPHLKSZNRMFL2KTXQJA5CNFSM6AAAAABVEVGTUWWGG33NNVSW45C7OR4XAZNFJFZXG5LFVJRW63LNMVXHIX3JMTHKMHEEG4.gif" height="1" width="1" alt="" /><span style="color: transparent; font-size: 0; display: none; visibility: hidden; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0; mso-hide: all">Message ID: <span><openstreetmap/openstreetmap-website/pull/5497</span><span>@</span><span>github</span><span>.</span><span>com></span></span></p>
<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/openstreetmap/openstreetmap-website/pull/5497",
"url": "https://github.com/openstreetmap/openstreetmap-website/pull/5497",
"name": "View Pull Request"
},
"description": "View this Pull Request on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>