Updates

[Kieran Hardern]

I've applied 2 updates to the server code today.

 

Out-of-band parameter

 

This is detailed here: viewtopic.php?f=134&t=64911#p467808

 

Confirmation step

 

Members now receive some information after logging in, to explain exactly what will happen if they proceed (i.e. your information will be granted to this site). The 'remember me' option has now been moved to that page, to allow you to byp[Mod - Happy Thoughts] that step each time. I would appreciate some people letting me know if what I've written makes sense or needs some changes (it's quite late at night here! :p).

[Kieran Hardern]

Bugfix applied today. There was an issue with new members being redirected to the dashboard instead of to the new confirmation page. Should now be fixed.

[Kieran Hardern]

SSO.cl[Mod - Happy Thoughts].php in the demo files has been updated to fix an issue with utilising HMAC. I suggest you re-download this file if you are using it on your server (even if you're using RSA).

[Kieran Hardern]

A few minor updates, mostly to the signup process. One key update to the functionality is a new "Return to this Site" option. When members choose to cancel their login, they can therefore cancel and remain with VATSIM or cancel and be redirected.

 

The redirect takes members to the callback, with oauth_token and oauth_verifier still set, though null. I've also added another parameter (not in the OAuth spec), oauth_cancel. If that's set, it definitively says the user cancelled their login. Though, you can equally use the absence of token & verifier to determine this.

 

I will update the code example soon. A few more updates in progress

 

Edit: Note that this is only on the demo area, not yet on the live system

[Kieran Hardern]

I've added a new output format to the api calls: "plain" (in addition to json and xml).

 

This format is only intended for those using libraries that handle the response in addition to the request (and therefore stick to the urlencoded return specified by the OAuth spec). I'd advise not to use this unless you need to for this reason, as it's rather archaic. For that reason, I'm not updating my demo code to work with this option - there's no advantage for you unless you're reading this from 1995.

 

To use this, simply suffix the api request pages with "/plain". e.g. https://cert.vatsim.net/sso/api/login_token/plain/. (Note: this is possible to switch between all other output types: /json/, /xml/, /plain/). The return will be a urlencoded string, e.g.:

 

message=&oauth_token=hh5s93j4hdidpola&oauth_token_secret=hdhd0244k9j7ao03&oauth_callback_confirmed=true&result=success

 

This additionally works on the /login_return/ page, though you shouldn't ever need that as it's the resource return. In case you feel like using it anyway, the output has to be slightly different than the multidimensional return of the other pages, I'll detail this fully in the system overview.