Login server - anyone want one?

[JontomXire]

Hi, all.

I dream of writing my own multiplayer RPG one day. Something simple like "Unturned" but for multiplayer would satisfy me - at keast at first. But with 20 years commercial software development experience including absolutely no graphics development, a house full of kids, and a busy life, I know I have no chance of going it alone.

But still...so I started small.

I am currently working on a login server that can run separately to a game server and authenticate users, allowing you to use your game servers to power your game without wasting CPU cycles on trivial stuff like user management. It's designed to be fairly open, so that it can authenticate users for multiple games and so on.

It's written in C and will support IPv6 as well as IPv4. Licensing is to be decided. I want it to be free and open source for non-commercial use, but if it gets picked up by a game that goes commercial etc. I'd like a bit of a kick back even if only getting to play that game for free for the rest of my life

The login server works like this:

Game server uses "server" library to connect to login server and register itself. A game server can be a different "realm" in an MMORPG, or maybe the game has lots of fans all running their own servers as per Quake or Minecraft.

The game server specifies its address, port, game name and server name. It receives in return a public key, although that is hidden within the library. The game server can then disconnect.

The game clients then use the "client" library to connect to the login server. They can register or login depending on whether they already have an account or not.

The game clients receive an "authentication token". They can then query the login server for a list of games, and for a game a list of servers.

The game clients then connect to the game server chosen from the list. They pass the authentication token to the game server.

The game server uses the "server" library to obtain from the authentication token a unique user ID (which they can use to look up characters or other save game data for the user, prevent duplicate logins etc.) and a login timestamp which they can use to prevent stolen authentication tokens being used to login.


Progress so far is that I've written the basic connection routines and a basic daemon for the login server. Progress is a little slow due to all the distractions I mentioned earlier.

I'd love some feedback and to know if you would be interested in using it in any multiplayer games you have.

Also if anyone has a good online multiplayer game I can get involved in on a low contributory basis I'd love to hear from you. One day I'll retire and the kids will have left home and I'll have more time

[andrewj]

Perhaps look at OAuth for some hints (RFC-5849 etc), as getting these kind of protocols right is pretty hard.

Good luck!

[JontomXire]

OAuth does a lot more than I need to do, and seems to do more than it needs to do to be honest. And it's not even that secure - from the example usage given, it seems to be that the third party being authenticated can access any of the private content it likes for a significant length of time, and without the end user being aware of it at all. Because it's web focussed, it doesn't offer the user the option of specifying which assets they are authorising, or how long they are authorising the asset for. That would be a bit complicated for a lot of users to worry about. And it's all meant to be transparent to the user to make a seamless web experience. Unfortunately the more seamless it is the more insecure it needs to be to avoid bothering the user over every little bit of detail.

I'm pretty sure my solution will be plenty secure enough. And I can make my authentiation tokens more secure by making them bigger and filling them full of random garbage before encrypting them.