Github is dropping support for HTTP basic auth

Github is dropping support for basic auth on Nov 13, 2020 (with service brownouts on Sep 30 and Oct 28) https://developer.github.com/changes/2020-02-14-deprecating-password-auth/

We should make sure that we support using personal access tokens with the Authorization: token header. We may also want to issue deprecation warnings if users continue to use basic auth: https://github.com/github-api/github-api/blob/5c9474d1c891121f11ce9c31b51d42216a8e416f/src/main/java/org/kohsuke/github/GitHubClient.java#L119-L123

[madhephaestus]

Good News: this can be made to work, and here is my working code:

https://github.com/CommonWealthRobotics/GithubPasswordManager/blob/da128e46d6d58b5898f9fd155f6edc7297f6a7e7/GithubPasswordManager/src/main/java/com/neuronrobotics/bowlerstudio/scripting/GitHubWebFlow.java#L62

Down Side: it would seem that the web-flow does not lend itself to the existing code framework. The first piece that is out of pipeline is that the user needs to interact with a web page presented by Github:

https://github.com/CommonWealthRobotics/GithubPasswordManager/blob/da128e46d6d58b5898f9fd155f6edc7297f6a7e7/GithubPasswordManager/src/main/java/com/neuronrobotics/bowlerstudio/scripting/GitHubWebFlow.java#L152

After that completes, there needs to be a server to recive the temporary code, this server needs to have a known address and that address has to be set in the OAuth app. GOOD NEWS is that you can make this URL a localhost

http://localhost:3737/success

Which is provided here by a Jetty servlet in our login flow:

https://github.com/CommonWealthRobotics/GithubPasswordManager/blob/da128e46d6d58b5898f9fd155f6edc7297f6a7e7/GithubPasswordManager/src/main/java/com/neuronrobotics/bowlerstudio/scripting/GitHubWebFlow.java#L86

On the event of the users agreeing to allow the applications requested scopes, GitHub will redirect to the localhost URL with the temp code.

Once you have the temp code, you are ready to ask for a token. This token request uses a different base URL and API from the original token request.

I would love help converting this function into a built in call:

https://github.com/CommonWealthRobotics/GithubPasswordManager/blob/da128e46d6d58b5898f9fd155f6edc7297f6a7e7/GithubPasswordManager/src/main/java/com/neuronrobotics/bowlerstudio/scripting/GitHubWebFlow.java#L191

The final change is that the token you get back can only be used with:

gh = GitHub.connectUsingOAuth( p);

from which the user can extract the username:

u=gh.getMyself().getLogin();

[bitwiseman]

@madhephaestus

The last I looked I think what I said was:

Finally, no, we don’t want to take a dependency on Jetty in the library. But we already use WireMock to proxy responses and record them for playback to tests. We might need to add an htmlServer() to GitHubWireMockRule.

If you find all the references to “uploads” in GitHubWireMockRule and add equivalent code for “html” that should do it. I’m sorry I don’t have bandwidth to do this myself right now, but it should be pretty much copy and paste with minor modifications.

https://github.com/hub4j/github-api/blob/8ababb60bffa6418a533d30536505b75c14c2a37/src/test/java/org/kohsuke/github/junit/GitHubWireMockRule.java#L62-L64

https://github.com/hub4j/github-api/blob/8ababb60bffa6418a533d30536505b75c14c2a37/src/test/java/org/kohsuke/github/junit/GitHubWireMockRule.java#L83-L85

You get the drift right? Would you be willing to take a swing at it? If you get stuck, I’d be happy to test/debug/help, but my plate is kind of full right now.