{"id":1533,"date":"2014-08-12T15:51:43","date_gmt":"2014-08-12T14:51:43","guid":{"rendered":"http:\/\/evemaps.dotlan.net\/blog\/?p=1533"},"modified":"2014-08-12T16:00:43","modified_gmt":"2014-08-12T15:00:43","slug":"eve-online-sso-activated","status":"publish","type":"post","link":"https:\/\/evemaps.dotlan.net\/blog\/2014\/08\/12\/eve-online-sso-activated\/","title":{"rendered":"Eve Online SSO activated"},"content":{"rendered":"

\"SSO<\/a>Couple weeks ago CCP FoxFour told us about the upcoming new SSO Login System<\/strong><\/a> for 3rd party sites. Well after\u00a0years of\u00a0hoping, weeks of testing on SISI and waiting again\u00a0they got finally ready and\u00a0within the scope of a limited\u00a0SSO trail\u00a0and allowed a few 3rd party websites to use their newly crafted SSO\u00a0(Single Sign On) System to be used.<\/p>\n

What does this mean?<\/strong><\/p>\n

You can now\u00a0login DOTLAN EveMaps using your Eve Online Characater (not account). Many social media sites are providing similar services (via OpenID, OAuth and OAuth2) like\u00a0Facebook, Twitter, Reddit or Google.<\/p>\n

Is it secure?<\/strong><\/p>\n

DOTLAN EveMaps or other 3rd party sites using the SSO Login Service will never see your eve account details (username, password, email, etc). As long as you pay attention when you get redirected to log in, you’re safe. But you should always do this when entering your credentials and double check them.<\/p>\n

I have already a DOTLAN EveMaps account and now?<\/strong><\/p>\n

The best way is now to log into your account using your old login method (email+password or facebook or twitter, etc.) and add an additional identity to your account. You’ll be able to login with all of your linked identities. If you try to login first with your Eve Account you might create a new account instead of link it to your existing one.<\/p>\n

Do we have any other benefits\u00a0when using Eve SSO as login method?<\/strong><\/p>\n

Nope. Right now CCP is just providing SSO as a Login service that provides the 3rd party site with your characterID, characterName and a hash so we can verify if the character\u00a0is still living on the same account. There’s no additional information we get.\u00a0For everything else we’ve still to rely on the old API keys, but this first initial step is the crucial requirement for the next big step: Authenticated CREST.\u00a0Someday we might get access to different scopes and request user details requesting permission from the user … but I guess this will take another year or so \ud83d\ude42<\/p>\n

Even on DOTLAN EveMaps I haven’t added any special features yet or\u00a0updated the API\u00a0verification process … but I guess other applications, corp or alliance management tools will be standing on the door step of CCP and waiting every moment\u00a0news.<\/p>\n

I’m a\u00a0developer, where do I get my\u00a0OAuth2 credentials for my own applications?<\/strong><\/p>\n

This was the first and initial trail run and test for CCP. They take their login system serious and are afraid of potential security breaches. The time for the first sisi trails even got pushed ahead multiple times. The\u00a0client credentials were created manually by CCP Devs inside the database. Once the Developer Site, where you can register your application\u00a0with application name, backcall_url, etc., goes live you’ll see more websites using this method as it\u00a0ensures that the user on the browser site is in charge of the API keys he’s\u00a0providing. No more API Key Changing, Evemail verifications or 1 isk transactions will be needed to verify you on those multiple alliance\u00a0or corporation management tools out there. One day …<\/p>\n

I the meantime I would advice you to get familiar with OAuth2 login procedure (for websites) in general. Once CCP has finished their developer site you’re in the first line of requesting one.<\/p>\n

Links<\/strong><\/p>\n