These forums have been archived and are now read-only.

The new forums are live and can be found at https://forums.eveonline.com/

EVE Technology Lab

 
  • Topic is locked indefinitely.
 

SSO Login for local program

First post
Author
Previous Topic Next Topic
Mallard Haven
Zero Effect Industries
#1 - 2016-12-20 15:10:48 UTC
Hi,

I'm looking for a bit of advice from people that have used the SSO login...

I have built a database "application" that I use to manage my industrial activity in game. Currently I download data using the older APIs, but given that things are changing I figured I'd better pull my finger out and rebuild sections so that they address the new API. At the moment I use SQL Server Integration Services (SSIS) script tasks to run a c# scripts to address the various APIs and download the data I want and load it into an SQL server.

I have been reading up on the SSO login, and I have some concerns that things might become a little tricky. First of all I am not sure that SSIS will allow itself to be paused to have login details entered into a web page. Can anyone suggest the best mechanism?

I'm also a little unclear on how exactly I should handle the call back part of the sign in process. Any clues on the best way to handle something that will only ever be used to access my characters?

Lastly I am not all that familiar with Swagger and I've not really found a good guide to help us poor Microsoft programmers...can anyone recommend a good guide for .net interactions with swagger?

Cheers - Mallard
Steve Ronuken
Fuzzwork Enterprises
Vote Steve Ronuken for CSM
#2 - 2016-12-20 18:23:09 UTC
If it's for personal use, I'd suggest writing a quick web service to auth with scopes. With that, you can get a refresh token. You can then use that in your application to do the authentication required, without a requirement for user input.


Woo! CSM XI!

Fuzzwork Enterprises

Twitter: @fuzzysteve on Twitter
Snitch Ashor
Republic Military School
Minmatar Republic
#3 - 2016-12-20 19:19:27 UTC
I think theres two ways, either have the app run a local webserver, then use the external browser for auth and the localhost as redirect url to get the auth code, thats how pyfa does it.
Second would be to include a webbrowser in your apllication, i did that in java where its straight forward, might be more tricky in your case.
Aleksey Rzhegov
Aliastra
Gallente Federation
#4 - 2016-12-21 08:55:02 UTC  |  Edited by: Aleksey Rzhegov
Is there any other way to authorize user without SSO?
What about API key? Does it work with ESI?
I tried to use it the same way as with CREST API, but it didn't work. (401 UNAUTHORIZED)
( example: https://esi.tech.ccp.is/latest/characters/{character_id}/wallets/?keyID={key}vCode={code}&datasource=tranquility )
There is a Mobile app, i really doubt it has a web server running or built-in browser only for authorization purposes.
There are also applications like EFT, which also using API key, they probably should have thought about it.

Edit: mobile app actually shows authorization page, so it looks like it is using web engine to receive token.
Steve Ronuken
Fuzzwork Enterprises
Vote Steve Ronuken for CSM
#5 - 2016-12-21 11:13:19 UTC
The method that wasn't mentioned to you, is registering a custom url scheme handler. Which is the way mobile apps tend to work.

it throws you out to the web browser, you auth, and then it redirects you to something like eve://localhost/tokenshit which your client knows to throw back to the app. This can also work with desktop applications (it's just a little more painful to write. not much more).


Embedding a web browser in an app, for anything except an official application, is a really bad way to do it. Because you're asking the user to trust you not to be stealing their authentication details. Fine with an official app, but a third party app, well, I don't know the author, so I don't trust the author that way.




As I said, for personal use, write a quick web app, (you can use something like xampp to host it locally) to handle the authentication the _first_ time. This gets you a refresh token you can use for everything else.

Woo! CSM XI!

Fuzzwork Enterprises

Twitter: @fuzzysteve on Twitter
Mallard Haven
Zero Effect Industries
#6 - 2016-12-21 12:46:16 UTC
Steve Ronuken wrote:
The method that wasn't mentioned to you, is registering a custom url scheme handler. Which is the way mobile apps tend to work.

it throws you out to the web browser, you auth, and then it redirects you to something like eve://localhost/tokenshit which your client knows to throw back to the app. This can also work with desktop applications (it's just a little more painful to write. not much more).


Embedding a web browser in an app, for anything except an official application, is a really bad way to do it. Because you're asking the user to trust you not to be stealing their authentication details. Fine with an official app, but a third party app, well, I don't know the author, so I don't trust the author that way.




As I said, for personal use, write a quick web app, (you can use something like xampp to host it locally) to handle the authentication the _first_ time. This gets you a refresh token you can use for everything else.


Hi Steve,

Thanks very much for this information. I think using the refresh token is probably the best solution - and something to work on while everyone else is watching bad Christmas movies.

Cheers - Mallard
Aleksey Rzhegov
Aliastra
Gallente Federation
#7 - 2016-12-22 13:13:33 UTC  |  Edited by: Aleksey Rzhegov
Steve Ronuken wrote:
The method that wasn't mentioned to you, is registering a custom url scheme handler. Which is the way mobile apps tend to work.

it throws you out to the web browser, you auth, and then it redirects you to something like eve://localhost/tokenshit which your client knows to throw back to the app. This can also work with desktop applications (it's just a little more painful to write. not much more).


Embedding a web browser in an app, for anything except an official application, is a really bad way to do it. Because you're asking the user to trust you not to be stealing their authentication details. Fine with an official app, but a third party app, well, I don't know the author, so I don't trust the author that way.




As I said, for personal use, write a quick web app, (you can use something like xampp to host it locally) to handle the authentication the _first_ time. This gets you a refresh token you can use for everything else.


I already tried to use an embedded web server but it didn't work. How exactly do you redirect request to localhost?
I tried to set 'redirect_uri' to [localhost : server port] or [http://[::1]:port.], but Login page wouldn't show up with error ("The callback URI doesn't match the value stored for this client").
Here is an example:

https://login.eveonline.com/oauth/authorize?response_type=token&redirect_uri=[localhost address]&realm=ESI&client_id=[cliend id]&scope=[scopes]&state=evesso

After that i have added the same address to 'Referrer' header and login page showed up, but after i entered my login and pass it gave me another error. ('Some parameters are either missing or invalid') It looks like authorization page prevents use of localhost address.
Also i noticed that authorization page requires client_id (or else you will get 'Some parameters are either missing or invalid') and it looks like its generated by other web service (swagger page, for example). Am i wrong? Where else can i get this id?
In this example 'eveLauncherTQ' is used as client_id.

BTW I'm using java, and and right now because of the problems above i'm just displaying swagger authorization window for user using WebView (JavaFX web engine), and i would be really grateful if someone described how to avoid it.
Steve Ronuken
Fuzzwork Enterprises
Vote Steve Ronuken for CSM
#8 - 2016-12-22 14:27:56 UTC
When you set up the client on the developers site, you have to specify the url that it will redirect back to. That has to match your request.

Woo! CSM XI!

Fuzzwork Enterprises

Twitter: @fuzzysteve on Twitter
Aleksey Rzhegov
Aliastra
Gallente Federation
#9 - 2016-12-22 15:05:41 UTC  |  Edited by: Aleksey Rzhegov
Looks like you can't set redirect link to https://localhost, but eve://localhost:port works fine. Can't check it now, but as far as i understand this link will open EVE browser with given address, so it should work. Also setting client_id of my application prevents from receiving validation errors.
Steve Ronuken, thanks a lot.
Steve Ronuken
Fuzzwork Enterprises
Vote Steve Ronuken for CSM
#10 - 2016-12-22 15:30:36 UTC
Aleksey Rzhegov wrote:
Looks like you can't set redirect link to https://localhost, but eve://localhost:port works fine. Can't check it now, but as far as i understand this link will open EVE browser with given address, so it should work. Also setting client_id of my application prevents from receiving validation errors.
Steve Ronuken, thanks a lot.

BTW have i missed some documentation describing all this stuff? If it is so, where can i find it? All if found was this link, but it's obviously does not fit for new ESI API.



you can do http://localhost (or at least, you used to be able to. I did in the past)

Woo! CSM XI!

Fuzzwork Enterprises

Twitter: @fuzzysteve on Twitter
Aleksey Rzhegov
Aliastra
Gallente Federation
#11 - 2016-12-22 15:38:52 UTC  |  Edited by: Aleksey Rzhegov
Steve Ronuken wrote:



you can do http://localhost (or at least, you used to be able to. I did in the past)


Just checked, http works, but https does not. (i tried to use https because developers website recommends so)
Steve Ronuken
Fuzzwork Enterprises
Vote Steve Ronuken for CSM
#12 - 2016-12-22 18:21:08 UTC
Aleksey Rzhegov wrote:
Steve Ronuken wrote:



you can do http://localhost (or at least, you used to be able to. I did in the past)


Just checked, http works, but https does not. (i tried to use https because developers website recommends so)



Https would probably work, but your server probably doesn't support it (it can be a bit of a pain to configure, comparatively)

If it's happening entirely locally, http is just fine. It's only if it's traversing the net (between your client, and your server process) that it can be a problem.

Woo! CSM XI!

Fuzzwork Enterprises

Twitter: @fuzzysteve on Twitter