Attempt to exchange Google's authorization code when given one instead of as a JWT #997

flaviofernandes004 · 2023-03-17T14:02:48Z

To actually run the server with the code in this PR, the following steps are necessary:

Install golang
Compile it by executing go build -trimpath -mod=vendor at the root folder and this should create a nakama file
Launch the db in another terminal session docker-compose -f ./docker-compose-postgres.yml up postgres
Set up a local config file for Nakama (check this page) and add the new credentials (More details can be found after this instruction list)
Run the previously compiled server by executing ./nakama --name nakama1 --database.address postgres:localdb@0.0.0.0:5432/nakama --logger.level DEBUG --session.token_expiry_sec 7200 --config ./<insert-nakama-custom-conf-location>.yaml

Notice that in step 5 we are, essentially, replacing the db address from postgres:localdb@**postgres**:5432/nakama to postgres:localdb@**0.0.0.0**:5432/nakama. To allow your local process to communicate with the database running in docker.

New configuration that is required to allow the server to exchange the authorization code for an access token.

# It should be added to Nakama's configuration file (https://heroiclabs.com/docs/nakama/getting-started/configuration/#specifying-a-config-file).
google_auth:
  credentials_json: |
    {
      "web": {
        "client_id": "...",
        "project_id": "...",
        "auth_uri":"...",
        "token_uri": "...",
        "auth_provider_x509_cert_url": "...",
        "redirect_uris": [
           "..."
        ]
      }
    }

It should be obtained by following these instructions: https://developers.google.com/games/services/console/enabling#b_create_a_credential

…d of as a JWT

… other sources

flaviofernandes004 · 2023-03-20T16:24:19Z

social/social.go

+ c.logger.Debug("Exchanged an authorization code for an access token.", zap.Any("token", t), zap.Error(err))
+
+ profile := GooglePlayServiceProfile{}
+ if err := c.request(ctx, "google play services", "https://www.googleapis.com/games/v1/players/me?access_token="+url.QueryEscape(t.AccessToken), nil, &profile); err != nil {


this requires the following scope: https://developers.google.com/games/services/web/api/players/get#auth

Let's make sure this gets documented. 👍

andreparodi-bandai · 2023-03-21T11:07:15Z

I was able to authenticate correctly with version 0.11.1 of the google play unity plugin. So I'd say it's working.

Couple of things regarding the config:

It also requires client_secret
I left the redirect_uris empty. Not sure how this is applicable to a game.

flaviofernandes004 · 2023-03-21T11:26:02Z

Awesome, thank you for taking a look.

The content of the config google_auth.credentials_json depends only on Google, I made no assumptions about it's schema. Configuration errors at that level will be logged and then it's up to the developer to adjust whatever is necessary in the Google's Console.

zyro · 2023-03-21T16:50:50Z

main.go

@@ -132,8 +134,18 @@ func main() {
 // Check migration status and fail fast if the schema has diverged.
 migrate.StartupCheck(startupLogger, db)

+ var googleAuthConf *oauth2.Config


Move this into the config, similar to the RuntimeConfig.Environment field which is computed and stored after config is read.

zyro · 2023-03-22T10:27:52Z

social/social.go

+ c.logger.Debug("Exchanged an authorization code for an access token.", zap.Any("token", t), zap.Error(err))
+
+ profile := GooglePlayServiceProfile{}
+ if err := c.request(ctx, "google play services", "https://www.googleapis.com/games/v1/players/me?access_token="+url.QueryEscape(t.AccessToken), nil, &profile); err != nil {


Let's make sure this gets documented. 👍

* master: (27 commits) Satori API integration fixes (heroiclabs#1005) Attempt to exchange Google's authorization code when given one instead of as a JWT (heroiclabs#997) manually revert protobufany and updategroup in swagger.json (heroiclabs#1003) Make haystack cursors consistent with listing (heroiclabs#994) Support purchases-not-null-uid.sql migration on crdb. (heroiclabs#992) Add runtimes satori integration (heroiclabs#993) Disconnect banned users (heroiclabs#1001) Add runtime http insecure flag (heroiclabs#1002) Add Go runtime GroupUpdate userID param (heroiclabs#996) Better handling of matchmaker operations while the interval process is running. Ensure direct message channel message listing is correctly scoped to participants only. Update get purchase/subscription signature (heroiclabs#990) Fix reversal of open/closed group listing filter (heroiclabs#989) Always log out a deleted user (heroiclabs#987) Listing returned vars (heroiclabs#986) Add tournament record delete runtime functions. (heroiclabs#977) Improve google refund polling handling. (heroiclabs#982) Console user and authentication improvements. (heroiclabs#978) Console session handling improvements. (heroiclabs#979) Fix google purchase upsert query. (heroiclabs#973) ... # Conflicts: # console/ui/dist/prod-nt/index.html # console/ui/dist/prod/index.html

* master: (27 commits) Satori API integration fixes (heroiclabs#1005) Attempt to exchange Google's authorization code when given one instead of as a JWT (heroiclabs#997) manually revert protobufany and updategroup in swagger.json (heroiclabs#1003) Make haystack cursors consistent with listing (heroiclabs#994) Support purchases-not-null-uid.sql migration on crdb. (heroiclabs#992) Add runtimes satori integration (heroiclabs#993) Disconnect banned users (heroiclabs#1001) Add runtime http insecure flag (heroiclabs#1002) Add Go runtime GroupUpdate userID param (heroiclabs#996) Better handling of matchmaker operations while the interval process is running. Ensure direct message channel message listing is correctly scoped to participants only. Update get purchase/subscription signature (heroiclabs#990) Fix reversal of open/closed group listing filter (heroiclabs#989) Always log out a deleted user (heroiclabs#987) Listing returned vars (heroiclabs#986) Add tournament record delete runtime functions. (heroiclabs#977) Improve google refund polling handling. (heroiclabs#982) Console user and authentication improvements. (heroiclabs#978) Console session handling improvements. (heroiclabs#979) Fix google purchase upsert query. (heroiclabs#973) ...

flaviofernandes004 force-pushed the ff-fix-auth-flow branch 2 times, most recently from 24faccf to 772a5d7 Compare March 17, 2023 14:05

flaviofernandes004 changed the title ~~Attempt to exchange Google's authorization code when given one instead of as a JWT~~ [WIP] Attempt to exchange Google's authorization code when given one instead of as a JWT Mar 17, 2023

Attempt to exchange Google's authorization code when given one instea…

1f41b96

…d of as a JWT

flaviofernandes004 force-pushed the ff-fix-auth-flow branch from a167763 to 1f41b96 Compare March 20, 2023 14:33

flaviofernandes004 added 2 commits March 20, 2023 15:42

Introduce GoogleProfile interface to enable user info extraction from…

a9d48ce

… other sources

Introduce a new profile struct with data obtained using the access token

581f78c

flaviofernandes004 commented Mar 20, 2023

View reviewed changes

flaviofernandes004 changed the title ~~[WIP] Attempt to exchange Google's authorization code when given one instead of as a JWT~~ Attempt to exchange Google's authorization code when given one instead of as a JWT Mar 20, 2023

Fix log message

2a78491

zyro requested changes Mar 22, 2023

View reviewed changes

flaviofernandes004 added 3 commits March 22, 2023 11:27

Move the instantiation of Google's OAuth2 into the config parsing logic

b37066b

Fix typo

84e95e3

Merge remote-tracking branch 'origin/master' into ff-fix-auth-flow

c537f04

zyro approved these changes Mar 22, 2023

View reviewed changes

flaviofernandes004 merged commit f2588f2 into master Mar 22, 2023

flaviofernandes004 deleted the ff-fix-auth-flow branch March 22, 2023 18:23

flaviofernandes004 mentioned this pull request Apr 21, 2023

Google Play Games v0.11.x is incompatible with Nakama 3.13.1 #915

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Attempt to exchange Google's authorization code when given one instead of as a JWT #997

Attempt to exchange Google's authorization code when given one instead of as a JWT #997

flaviofernandes004 commented Mar 17, 2023 •

edited

Loading

flaviofernandes004 Mar 20, 2023

zyro Mar 22, 2023

andreparodi-bandai commented Mar 21, 2023

flaviofernandes004 commented Mar 21, 2023 •

edited

Loading

zyro Mar 21, 2023

zyro Mar 22, 2023

Attempt to exchange Google's authorization code when given one instead of as a JWT #997

Attempt to exchange Google's authorization code when given one instead of as a JWT #997

Conversation

flaviofernandes004 commented Mar 17, 2023 • edited Loading

flaviofernandes004 Mar 20, 2023

Choose a reason for hiding this comment

zyro Mar 22, 2023

Choose a reason for hiding this comment

andreparodi-bandai commented Mar 21, 2023

flaviofernandes004 commented Mar 21, 2023 • edited Loading

zyro Mar 21, 2023

Choose a reason for hiding this comment

zyro Mar 22, 2023

Choose a reason for hiding this comment

flaviofernandes004 commented Mar 17, 2023 •

edited

Loading

flaviofernandes004 commented Mar 21, 2023 •

edited

Loading