Possible to support openid connect authentication flow?

[mas-bandwidth]

Possible to support openid connect authentication flow?

[gafferongames]

I think that stuff is a great idea, eventually the backend matcher should be able to be extended (or integrated with your own matcher) that provides this auth, and then it creates the connect token to pass to the yojimbo dedicated server on connect. But I don't plan to add this functionality directly to yojimbo.

[fire]

Can you leave details hints where this functionality can be added? It would be helpful.

I'm tempted to write my own backend just for fun. With elixir and maybe phoenix or grpc.

[gafferongames]

Take a look at matcher.go. Matcher.go is an example showing how a web backend can create and return a connect token to a client over HTTPS. The client then uses this connect token in secure_client.cpp to establish a secure connection to a yojimbo server (encrypted, authenticated via matcher), and if you are running secure_server.cpp, insecure connections are not allowed, all client connections must come in with connect tokens.

So the basic idea is that you extend matcher.go to create your own backend, or port the code in matcher.go to your own backend, perhaps in some different language, so you can create a connect token and return the matcher HTTPS response that the yojimbo client is expecting. Then, the whole OpenID stuff you would do on that backend, authenticating users, and only allowing OpenID authenticated users to request and receive connect tokens.

This way, the OpenID authentication in your backend is effectively transferred to yojimbo servers when you run them in secure mode (#define YOJMIBO_SECURE_MODE 1), because those servers only allow connections with connect tokens, and only users that have authenticated with OpenID are able to get connect tokens from your backend.

This is how the whole yojimbo thing is supposed to work. The connect tokens are the bridge between whatever auth you implement in your backend and the dedicated servers.

ps. Before you go into production with this, make sure you roll a new private key for the matcher (or your own backend), and the dedicated servers instances. The security of this system relies on the private key being known only to the backend and dedicated server instances.

cheers

• Glenn