Difference between revisions of "Standards:GMCP Authentication"

Revision as of 08:52, 19 February 2024

GMCP Extension for MUD Client Authentication

This document defines a new GMCP extension to enable MUD clients to send credentials and perform authentication using GMCP messages instead of in-band login commands. It also includes optional support for OAuth authorization flows.

Rationale

Different MUDs have diverse login command formats, making it challenging for MUD clients to handle login consistently. This extension provides a standardized way to exchange authentication information through GMCP, simplifying client development and improving compatibility. Additionally, the extension supports OAuth authorization flows, allowing clients to leverage external identity providers for login.

Design

The extension introduces a new namespace called Client.Authenticate with the following commands:

Server-side

Client.Authenticate.Default

Sent in response to Client.Supports.Set, it informs the client of the supported authentication methods:

type (array of strings, required): indicates the supported method(s), which is one or more of:
- password-credentials: traditional username/password login.
- oauth: OAuth-based login.
location (string, required if type is oauth): openid-configuration location. See https://openid.net/specs/openid-connect-discovery-1_0.html

Since multiple flows can be supported by a server, the type array shall be ordered in the descending order of preference by the server. For example, if the server supports only the credentials flow:

 Client.Authenticate.Default {"type": ["password-credentials"]}

If the server supports both OAuth and credentials and prefers OAuth:

 Client.Authenticate.Default {"type": ["oauth", "password-credentials"], "location": "https://example.com/.well-known/openid-configuration" }

Client.Authenticate.Result

Sent in response to Client.Authenticate.Credentials, it informs the client of the success or failure of the credentials-based login.

success: (boolean, required) Indicates whether the authentication attempt was successful.
message: (string, required if success is false) required string if the login wasn't successful: a human-readable message explaining the result, such as "Invalid credentials" or "Character not found".

Client-side

Client.Authenticate.Credentials

After receiving Client.Authenticate.Default with type as password-credentials, the client sends the character name and password for traditional login.

account (string, required): character name or the player account name. For games that implement both player and character names, the character name can be included after a colon (:), for example myaccount:mycharacter.
password (string, required): character password. Servers are encouraged to implement TLS over telnet to allow secure transmission of passwords.

Example Flow (Password Credentials):

Client connects and sends: Core.Supports.Set ["Client.Authenticate 1", ...]
Server responds with: Client.Authenticate.Default {"type": ["password-credentials"]}
Client sends: Client.Authenticate.Credentials {"account": "username", "password": "password"}
Server validates credentials and performs login.

Example password flow (source)

OAuth Flows

Specific details for the OAuth flow will be detailed once it is worked out with the community.

Implementation Considerations

This extension should be implemented according to the GMCP protocol specifications.
Messages should be well-formatted JSON objects.
Servers should validate incoming authentication information securely.
Clients should handle potential errors and server responses gracefully.

Conclusion

This GMCP extension provides a standardized and flexible approach to MUD client authentication, improving compatibility and enabling support for OAuth authorization flows. By adopting this extension, MUD developers and client developers can simplify login processes and enhance user experience.

Note: This is a draft proposal, and further community input and refinement may be necessary before finalizing the specification. Additionally, the specific details of OAuth flow support require input from the community to be defined.

@@ Line 39: / Line 39: @@
 After receiving <code>Client.Authenticate.Default</code> with <code>type</code> as <code>password-credentials</code>, the client sends the character name and password for traditional login.
-* <code>account</code> (string, required): character name or the player account name. For games that implement both player and character names, the character name would be handled in plain text outside of this spec.
+* <code>account</code> (string, required): character name or the player account name. For games that implement both player and character names, the character name can be included after a colon (:), for example <code>myaccount:mycharacter</code>.
 * <code>password</code> (string, required): character password. Servers are encouraged to implement [[Manual:Supported Protocols#Secure connection .28TLS.29|TLS over telnet]] to allow secure transmission of passwords.