| 01:20.04 | *** join/#bzflag infobot (ibot@rikers.org) |
| 01:20.04 | *** topic/#bzflag is https://BZFlag.org || http://ohloh.net/p/bzflag || https://bzflag.org/help || Channel Logs: http://infobot.rikers.org/%23bzflag/ || 2.4.12 released! https://forums.bzflag.org/viewtopic.php?f=62&t=19720 |
| 01:20.04 | *** mode/#bzflag [+v infobot] by ChanServ |
| 04:36.26 | *** join/#bzflag a_meteorite (~a_meteori@unaffiliated/ameteorite/x-000000001) |
| 06:14.19 | *** join/#bzflag nadir (uid134094@gateway/web/irccloud.com/x-jvtysfqkihvnfghc) |
| 14:13.23 | *** join/#bzflag echelon (~echelon@bzflag/player/echelon) |
| 14:42.37 | *** join/#bzflag nadir (uid134094@gateway/web/irccloud.com/x-nqkxmknntgjrntxq) |
| 14:51.39 | blast007 | What information should our weblogin system provide to a third-party service? Currently we provide specificly requested group memberships (checked when the token is validated). Would it be a problem if it just returned all group memberships? Should it be able to provide the user's email address? Should it be possible to give partial access to a BZFlag account to a third-party, for instance, to be |
| 14:51.45 | blast007 | able to send private messages as that ... |
| 14:51.47 | blast007 | ... player? |
| 14:51.54 | blast007 | meh.. that line wrap script is a bit broken.. |
| 15:05.07 | blast007 | I'm thinking that we should be switching our weblogin system to some standard system like OpenID, OAuth, or OpenID Connect |
| 15:10.51 | *** join/#bzflag I_Died_Once (~I_Died_On@unaffiliated/idiedonce/x-1828535) |
| 15:41.41 | *** join/#bzflag I_Died_Once_ (~I_Died_On@unaffiliated/idiedonce/x-1828535) |
| 16:04.04 | JeffM | you could leak info by sending out all groups. |
| 16:04.16 | JeffM | like who is a secret admin |
| 16:04.53 | JeffM | who gets granted the email address all sites that ask or just authorized ones> |
| 16:05.11 | JeffM | same question for sending PMs |
| 16:05.22 | JeffM | What are the use cases for the later two features? |
| 16:05.53 | blast007 | I don't know how the various solutions work. Just trying to determine our hard requirements and "would be nice" features. |
| 16:05.58 | JeffM | sure |
| 16:06.41 | blast007 | of lot of the articles are OpenID are about being a third-party service, not about being a provider :) |
| 16:06.47 | blast007 | about OpenID* |
| 16:06.51 | JeffM | I would only send requested groups. I would NEVER provide access to the end user email, if need be I'd provide a function for services to send an email to the user on behalf of the site. Same for PMs. |
| 16:07.24 | JeffM | yes, the main point of using open ID is so you don't have to build your own auth system |
| 16:07.31 | JeffM | so people can use existing accounts. |
| 16:07.43 | JeffM | is there any reason to keep your own userdb? |
| 16:08.17 | blast007 | because I don't want to be dependent on third-party services for our logins |
| 16:08.51 | blast007 | plus, that wouldn't really work too well in-game |
| 16:08.56 | blast007 | if we were just a website, maybe |
| 16:09.07 | JeffM | so then only advantage of using openID is that there are login components for sites already. |
| 16:10.02 | JeffM | is there an openID lib you'd use in game, or would you have to implment your own client code for that? |
| 16:10.21 | blast007 | I wouldn't use it for the game |
| 16:10.23 | blast007 | just weblogin |
| 16:10.38 | JeffM | ok, so you'd provide an openID portal into the auth system. |
| 16:10.44 | blast007 | yup |
| 16:11.14 | JeffM | what are the use cases for the sites you envision that need login? |
| 16:12.23 | blast007 | only two I'm actively aware of right now are Strayer's stats site (which the main feature you get by logging in is being able to add a friends list that show when/where your friends are) and the league sites, plus maybe some server adminstration/hosting panels. |
| 16:12.47 | blast007 | so, ideally it'd work similar to how it does now |
| 16:13.08 | JeffM | do you intend to work friends into the base services system? |
| 16:13.30 | blast007 | I just don't know if other systems have the concept of group membership (and if they do, if they support allowing the third-party service to specify which groups they care about) |
| 16:13.35 | blast007 | eventually, yes |
| 16:14.17 | JeffM | I think you have 2 things that you are mixing because the game server mixes them. |
| 16:14.28 | JeffM | so things that need authentication, just need to auth. |
| 16:14.44 | JeffM | the few sites that need groups, don't actualy need it in the context of a user login |
| 16:14.51 | JeffM | they need it in general (leagues). |
| 16:14.55 | JeffM | so why not just do auth. |
| 16:15.04 | JeffM | and then provide a restful api for group access. |
| 16:15.25 | blast007 | hmm, that could work too |
| 16:15.25 | JeffM | they have to provide the bzid, for the user, that they get from auth. |
| 16:15.43 | blast007 | organization level API keys |
| 16:15.45 | JeffM | a leauge site is going to possibly need to get info about OTHER player's groups. |
| 16:15.51 | blast007 | gives them access to their group data |
| 16:15.55 | JeffM | not just the user logging in |
| 16:15.56 | JeffM | yeah |
| 16:16.12 | blast007 | that'd actually be far better |
| 16:16.13 | JeffM | make auth be auth |
| 16:16.18 | JeffM | and groups be groups :) |
| 16:16.49 | JeffM | and if you need to act like a server, then use the server interface |
| 16:17.21 | blast007 | the checktoken stuff would end up only working for servers on the list |
| 16:17.37 | blast007 | since tokens would be tied to a server |
| 16:17.45 | JeffM | yeah |
| 16:17.54 | JeffM | no website needs to act like a server |
| 16:18.24 | JeffM | most sites that do auth, just want the BZID to use as a key for there own data |
| 16:18.55 | JeffM | leagues need groups. But they are going to need more than what the server gets |
| 16:19.08 | JeffM | they'll actualy need a list of BZIDs for all members of a group |
| 16:19.12 | JeffM | not just those that happen to login |
| 16:19.27 | blast007 | the leagues would live a writable API for groups :) |
| 16:19.32 | JeffM | if you limit yourself to what is done on a single user login, the leauge won't have data for a user that never logged into it. |
| 16:19.40 | JeffM | sure, optimally |
| 16:19.45 | blast007 | ban a player from their league site? removes them from the group. bam. |
| 16:19.56 | JeffM | so yeah, you need two seperate APIs. |
| 16:19.58 | JeffM | not one. |
| 19:04.12 | *** join/#bzflag echelon (~echelon@bzflag/player/echelon) |
| 19:17.38 | echelon | so was there a resoulution reach with regard to the compound map? :/ |
| 19:17.40 | echelon | Delusional? |
| 20:12.22 | *** join/#bzflag nadir (uid134094@gateway/web/irccloud.com/x-bwecmwcuacyxhsgr) |
| 20:36.49 | *** join/#bzflag Delusional_ (~Delusiona@unaffiliated/delusional) |
| 21:25.58 | JeffM | so a build of my server is running at www.hyperdrive.tech:5154 if anyone wants to try it :) |
| 21:34.03 | JeffM | whoever connected, thanks found it it crashes on reverse DNS lookups that fail :) |
| 21:49.29 | *** join/#bzflag bertman (~bert@unaffiliated/bertman) |
| 23:17.50 | *** join/#bzflag echelon (~echelon@bzflag/player/echelon) |
| 23:18.43 | Delusional | echelon⦠L4m3r is working on it. |
| 23:19.22 | Delusional | iâm pretty sure heâs going t get it runing |
| 23:25.05 | echelon | so he just doesn't wanna make it public? |
| 23:38.47 | Delusional | itâs not really suited for public release. Itâs not a ânormalâ map the way it plays |