[New SSO] VATSIM Connect Update

[Zach Biesse-Fitton]

Hi everyone,

VATSIM Connect is now running in full release. If your organisation is currently using the original VATSIM SSO, we strongly suggest to implement the new OAuth2 SSO system. A changeover process will be announced at a later date.

The system is available at: http://auth.vatsim.net/

We usually approved organisations with 24-48 hours.

Documentation can be found at: https://github.com/vatsimnetwork/developer-info/wiki/Connect 

(links to integration repositories are being added as they become available)

Questions can be added into the following forum: 

Thanks!

[Miguel Frias]

Managed to implement OAuth2 with no problems. Able to use the only [?] call available which is https://auth.vatsim.net/api/user   only for my own user

 

[Wildan Gunawan]

I think it will be better if displayed organization name to be Display Name that we set when we're registering the application instead of the identifier. I thought that the identifier is a key that we used in old SSO.

[Nestor Perez]

Yep, that's a bug. Adding it to the list of things to be fixed.

[Harrison Scott]

Hi @Wildan Gunawan,

The authorisation page has been updated to utilise the display name of the organisation. Additionally, the issue with the checkboxes has been rectified.

If you have any further issues just let us know,

Cheers

Harrison

[Blake Nahin]

It seems that after redirecting back from VATSIM, if successful, the return URL does not include the state parameter. It only has code. The state parameter is only included if access is denied.

[George Enciu]

Is there a way to find out who registered an organisation? I was trying to register our vACC with Display Name "VATSIM Romania" and Identifier " ROvACC" and i got the message that the names are already taken. Neither me nor the division director registered it.

[Nestor Perez]

9 hours ago, George Enciu said:

Is there a way to find out who registered an organisation? I was trying to register our vACC with Display Name "VATSIM Romania" and Identifier " ROvACC" and i got the message that the names are already taken. Neither me nor the division director registered it.

Yep, contact us at web(at)vatsim.net and we'll sort it out for you!🙂

[Steven Fauconnier]

Anyone implemented this on an SMF forum yet?

[Liam Pickering]

Morning,

It seems that Github link for documentation is dead. Mind posting a new one?

Cheers

[Jordan Jolenaar]

On 6/8/2021 at 3:06 AM, Liam Pickering said:

Morning,

It seems that Github link for documentation is dead. Mind posting a new one?

Cheers

Hi Liam,

I've updated the link, you should be able to see it now. Thanks for letting us know

[Kyle Porter]

Hello,

   I'm developing an application that includes VATSIM Connect integration. I've had a working live demo for a few months now that included SSO via the dev environment endpoint. In the last few days, my login sequence mysteriously broke without any changes on my end. I noticed that my client ID was deleted from the server (I registered a new one - no problem), but now I'm getting 400 bad request errors with a reply message "{"error":"invalid_request","error_description":"Invalid content type. Must be \"application\/x-www-form-urlencoded\"."}" Did something on the dev server change? Can someone confirm that the dev endpoint is currently operational? I've confirmed on my end that my POST request is indeed sending a content type header of application\/x-www-form-urlencoded. Again, this was working just fine last week and for some reason it's broke today. Any help would be appreciated.

Kyle

[Nestor Perez]

Hi Kyle, see the following thread:

I can confirm that you are indeed not setting the Content-Type header to "application/x-www-form-urlencoded", as it is a simple string comparison in the server, and there is still plenty of requests coming through which get a valid (200) response.

This "worked fine" because the server was not fully compliant with the OAuth2 spec and accepted more formats than the spec defines, which is obviously not how it should be. These changes you're seeing are part of a whole rewrite of the authentication system to make it fully OAuth2 compliant.

[Kyle Porter]

Thanks Nestor - I appreciate your reply. I was able to rebuild my POST string in compliance with the standard and I'm back up and running. Just couldn't figure out why it was working well last week and then broken without explanation. I appreciate your help!

[Nestor Perez]

Glad to hear! That's why we're running it in dev before pushing it to prod, so we know where people will need to be helped/warned the most!