Oversigt

Steamworks har flere metoder til at bekræfte en Steam-brugers identitet og bekræfte ejerskab af en applikation. Det følgende dokument beskriver hver af disse godkendelsesmetoder, som bruges i de følgende scenarier:

• Mellem en spilklient og andre klienter (P2P) eller spilservere, der bruger Sessionsbilletter
  
• Mellem en spilklient og backend-sever, som bruger:
  
  • Sessionsbilletter og Steamworks-web-API'en
    
  • Bibliotek med krypterede applikationsbilletter
    
• Når en bruger er i en webbrowser, som bruger OpenID og Steamworks-web-API

Identificering af en bruger indenfor Steam

Hver Steam-bruger kan identificeres entydigt ud fra et 64-bit numerisk ID, kendt som brugerens Steam-ID. En brugers Steam-ID er i Steamworks C++-API'er indeholdt i et CSteamID-objekt. Du kan hente den nuværende brugers Steam-ID ved at kalde ISteamUser::GetSteamID og derefter hende 64-bit-ID'et ved at kalde CSteamID.ConvertToUint64() på den returnerede værdi.

De følgende godkendelsesmetoder kan bruges til sikkert at bekræfte en brugers Steam-ID.

API'er beskrevet i dette dokument

Sessionsbilletter

Sessionsbilletter er signerede billetter, som kan bruges til at verificere en brugers identitet mellem brugerens spilklient og et vilkårligt antal af andre spilklienter (såsom i en peer-to-peer multiplayer-session) eller en lytte-/dedikeret spilserver (ved hjælp af ISteamGameServer API'en). Disse billetter kan også bruges til at bekræfte ejerskab af det aktuelle spil og relateret indhold, som kan downloades, og afgøre, om brugeren er blevet VAC-udelukket (se VAC (Valve Anti-Cheat) og spiludelukkelser).
Sessionsbilletter kan også bruges til at bekræfte en brugers identitet mellem en spilklient og en sikker backend-server ved at bruge Steamworks-web-API'en. Kræver, at den sikre server kan lave HTTPS-anmodninger til partner.steam-api.com.

Krypterede applikationsbilletter

Krypterede applikationsbilletter kan bruges til at bekræfte en brugers identitet mellem en spilklient og en sikker backend-server. I modsætning til sessionsbilletter kræver bekræftelse af krypterede applikationsbilletter ikke, at den sikre server kan lave HTTPS-anmodninger. I stedet bruges et C++-bibliotek og en privat, symmetrisk nøgle af den sikre server til at bekræfte billetten. The Steamworks SDK includes 32-bit and 64-bit versions of this library for Windows and Linux under the public/steam/lib directory.

Before using Encrypted Application Tickets, you must generate a private key for each title. You can do this by navigating to Edit Steamworks Settings for your application and selecting 'SDK Auth' from the 'Security' drop-down. This key will be associated with your title's AppID and any downloadable content for that title. In order to access this section of Steamworks, a user must have the "Manage Signing" permission for the relevant Application.

Steamworks-web-API

Steam exposes an HTTP based Web API which can be used to access many Steamworks features. The API contains public methods that can be accessed from any application capable of making an HTTP request, such as game client or server. The API also contains protected methods that require authentication and are intended to be accessed from trusted back-end applications. More details on the Web API can be found here.

P2P eller spilservere

Sessionsbilletter

Brugergodkendelse

The following steps detail how to use Session Tickets to verify a user's identity between the user's game client (client A) and another client or game server (client B):

• Klient A skal hente en sessionsbillet ved at kalde ISteamUser::GetAuthSessionTicket.
  
• Klient A skal sende sin sessionsbillet til klient B.
  
• Klient B skal sende klient A's billet til ISteamUser::BeginAuthSession, som vil udføre en hurtig gyldighedskontrol. Hvis billetten er gyldig, vil ISteamUser::BeginAuthSession videresende billetten til Steam-backenden for at bekræfte, at billetten ikke er blevet genbrugt, og er udstedt af kontoens ejer af klient A. Resultatet af denne bekræftelse vil blive returneret i et ISteamUser::ValidateAuthTicketResponse_t-tilbagekald.
  
• Når multiplayer-sessionen afsluttes:
  
  • Klient A skal sende handlet, som først blev returneret fra ISteamUser::GetAuthSessionTicket, til ISteamUser::CancelAuthTicket.
    
  • Klient B skal sende Steam-ID'et tilhørende klient A til ISteamUser::EndAuthSession.
    

A few important notes about Session Tickets:

• Sessionsbilletter må kun bruges én gang. ISteamUser::GetAuthSessionTicket skal kaldes for hver klient i multiplayer-sessionen, som anmoder om en billet.
  
• Når det bruges til at godkende spillere inden for en peer-to-peer multiplayer-session, bør hver spilklient bekræfte identiteten af alle andre spilklienter i multiplayer sessionen.
  
• Når processen er færdig med en sessionsbillet, skal ISteamUser::CancelAuthTicket kaldes for alle handles, som returneres af ISteamUser::GetAuthSessionTicket.
  
• Når klient A kalder ISteamUser::CancelAuthTicket, vil klient B modtage et ISteamUser::ValidateAuthTicketResponse_t-tilbagekald, som viser, at klient A's billet ikke længere er gyldig.
  
• Hvis klient A's kald til ISteamUser::CancelAuthTicket behandles før klient B's kald til ISteamUser::EndAuthSession, kan klient B modtage et ISteamUser::ValidateAuthTicketResponse_t-tilbagekald, som siger, at billetten blev annulleret, når klient A forlader et spil med klient B. Fordi der er enighed om, at klient A forlader spillet, kan dette tilbagekald ignoreres.
  
• Netværksforudsætninger kan forhindre Steam-backenden i at give et tilbagekald til den, der kalder ISteamUser::BeginAuthSession i en uendelig tidsperiode. Kalderen af ISteamUser::BeginAuthSession (klient B) bør ikke antage, at han kender klient A's sande identitet, før at dette tilbagekald er blevet modtaget, men bør tillade, at multiplayer-sessionen fortsætter.
  
• Hvis den, som kalder ISteamUser::BeginAuthSession, modtager et ISteamUser::ValidateAuthTicketResponse_t-tilbagekald, som siger, at billetten for klient A er ugyldig, skal kalderen nægte at fortsætte multiplayer-sessionen med klient A. Hvis de andre peers i spillet ikke også nægter at spille med klient A, bør kalderen forlade multiplayer-sessionen.
  
• ISteamGameServer har de samme sessionsbilletmetoder til at udføre godkendelse mellem en spilklient og en spilserver.

Bekræftelse af ejerskab

When using Session Tickets, Steam will automatically verify ownership of the current AppID. If the user does not own the current AppID, then m_eAuthSessionResponse field of the ISteamUser::ValidateAuthTicketResponse_t will be set to k_EAuthSessionResponseNoLicenseOrExpired. After receiving a user's Session Ticket and passing it to ISteamUser::BeginAuthSession then, ISteamUser::UserHasLicenseForApp can be used to determine if the user owns a specific piece of downloadable content.

Backend-server

Sessionsbilletter og Steamworks-web-API

Brugergodkendelse

The following steps detail how to use Session Tickets to verify a user's identity between the user's game client and a secure server:

• Klienten skal hente en sessionsbillet ved at kalde ISteamUser::GetAuthSessionTicket.
  
• For at være sikker på, at billetten er gyldig, skal klienten vente på ISteamUser::GetAuthSessionTicketResponse_t-tilbagekaldet.
  
• Klienten skal sende dens sessionsbillet til den sikre server.
  
• Den sikre server skal lave en HTTPS-anmodning til partner.steam-api.com og kalde webmetoden ISteamUserAuth/AuthenticateUserTicket og give brugerens sessionsbillet som en hex-kodet UTF-8-streng. Bemærk, at denne metode tillader enten en Steam-web-API-nøgle eller en web-API-udgivernøgle, som er tilknyttet app-ID'et for den givne billet, der skal sendes. En senere opdatering af denne API kan give flere oplysninger til kalderen, hvis der er angivet en web-API-udgivernøgle.
  
• Hvis brugerens billet er gyldig, vil ISteamUserAuth/AuthenticateUserTicket returnere brugerens 64-bit Steam-ID.

Bekræftelse af ejerskab

Once a user's identity has been verified, a secure server can use the ISteamUser/CheckAppOwnership Web API method to check if the user owns a particular AppID, or call ISteamUser/GetPublisherAppOwnership to retrieve a list of all user owned AppIDs that are associated with the provided Publisher Key.

Krypterede applikationsbilletter

Brugergodkendelse

The following steps detail how to use Encrypted Application Tickets to verify a user's identity between the user's game client and a secure server:

• Klienten skal kalde ISteamUser::RequestEncryptedAppTicket og vente på ISteamUser::EncryptedAppTicketResponse_t-kaldsresultatet.
  
• Klienten skal derefter kalde ISteamUser::GetEncryptedAppTicket for at hente brugerens krypterede billet og sende billetten til den sikre server.
  
• Ved at bruge biblioteket med krypterede applikationsbilletter skal den sikre server:
  
  • Kalde SteamEncryptedAppTicket::BDecryptTicket for at dekryptere brugerens billet
    
  • Kalde SteamEncryptedAppTicket::BIsTicketForApp for at bekræfte, at billetten er til den forventede applikation
    
  • Kalde SteamEncryptedAppTicket::GetTicketIssueTime for at bekræfte, at billetten ikke er udløbet (udløbstidspunkt er defineret af applikationen)
    
  • Kalde SteamEncryptedAppTicket::GetTicketSteamID for at hente brugerens Steam-ID
    

An example implementation can be found in the Steamworks-API-eksempel på applikation (SpaceWar) project in the SDK. Specifically CSpaceWarClient::RetrieveEncryptedAppTicket and CSpaceWarClient::OnRequestEncryptedAppTicket.

Bekræftelse af ejerskab

Steam will only create Encrypted Application Tickets for users who own the AppID for which the ticket was created. After decrypting an Encrypted Application Ticket, the secure server can use SteamEncryptedAppTicket::BIsTicketForApp to verify the AppID of the ticket matches the title's AppID. The server can also use SteamEncryptedAppTicket::BUserOwnsAppInTicket to determine if the user owns a specific piece of Indhold, der kan downloades (DLC).

Webbrowserbaseret bekræftelse med OpenID

Steam is an OpenID Provider, as described in the OpenID 2.0 specification. Inside a web browser, a third-party website can use OpenID to obtain a user's SteamID which can be used as the login credentials for the 3rd party website, or linked to an existing account on that website.

When using OpenID, the user begins in a web browser at the third-party website. When the user wishes to login/link their account to that website, using OpenID, the site directs the user to a login form on the Steam Community website. Once the user has entered their Steam login credentials, the user's web browser is automatically redirected back to the 3rd party website with some additional OpenID specific data appended to the return URL. The site's OpenID library can then use this data to verify and obtain the user's SteamID.

Steam provides the following images which may be used by 3rd party sites when linking to the Steam sign in page:

Brugergodkendelse

Steam's OpenID 2.0 implementation can be used to link a users Steam account to their account on the third-party website.
A list of open source OpenID libraries can be found at the OpenID website. To use OpenID to verify a user's identity:

• Konfigurer dit OpenID-bibliotek for at bruge den følgende URL som Steam's OP Endpoint URL: https://steamcommunity.com/openid/
  
• Efter en bruger er blevet bekræftet, vil brugerens tildelte ID indeholde brugerens Steam-ID. Steam's tildelte ID-format er:http://steamcommunity.com/openid/id/<steamid>.

Bekræftelse af ejerskab

Once a user's identity has been verified, a secure server can use the ISteamUser/CheckAppOwnership Web API method to check if the user owns a particular AppID, or call ISteamUser/GetPublisherAppOwnership to retrieve a list of all user owned AppIDs that are associated with the provided Web API Publisher Key.

Eksempler

Tilknytning af tredjepartskonti til Steam-konti

Third-party accounts can be linked to Steam accounts by associating a user's SteamID with the 3rd party account.

A user's SteamID can be securely retrieved either in-game or through a web browser and once the initial association has occurred, you can safely allow access to the 3rd party account by merely verifying a user's SteamID. This eliminates the need for Steam users to do any sort of secondary login to 3rd party account systems. Additionally, if new 3rd party accounts can be automatically created and linked when a new SteamID is encountered, the Steam user will never have to be aware that a secondary authentication is taking place at all. Instead, their single Steam account can grant access to all of their games, streamlining the user experience and removing potential barriers to installing and trying new games.

Tilknytning inde fra spil

Session Tickets can be used to verify a user's identity between a game client and a secure, backend server using the Steamworks Web API:

• Klienten skal hente en sessionsbillet ved at kalde ISteamUser::GetAuthSessionTicket.
  
• For at være sikker på, at billetten er gyldig, skal klienten vente på ISteamUser::GetAuthSessionTicketResponse_t-tilbagekaldet.
  
• Klienten skal sende dens sessionsbillet til den sikre server.
  
• Den sikre server skal lave en HTTPS-anmodning til api.steampowered.com og kalde webmetoden ISteamUserAuth/AuthenticateUserTicket og give brugerens sessionsbillet som en hex-kodet UTF-8-streng. Bemærk, at denne metode kræver en web-API-udgivernøgle, som er tilknyttet app-ID'et for den givne billet.
  
• Hvis brugerens billet er gyldig, vil ISteamUserAuth/AuthenticateUserTicket returnere brugerens 64-bit Steam-ID.

Tilknytning fra en webbrowser

Steam supports the OpenID 2.0 specification so that you can allow users to securly log into their Steam accounts from your website and retrieve their SteamID. For details on how to use OpenID with Steam go to Using OpenID

Bekræftelse af ejerskab

Once a user's identity has been verified, a secure server can use the ISteamUser/CheckAppOwnership Web API method to check if the user owns a particular AppID, or call ISteamUser/GetPublisherAppOwnership to retrieve a list of all user owned AppIDs that are associated with the provided Web API Publisher Key.

Overførsel fra tredjeparts-CD-nøgler til indbygget Steam-ejerskabstjek

Steam itself has a number of ways a title can authenticate a user with, removing the need for a third-party CD key. We've compiled a list of common use cases for CD Keys and how you might implement each case natively with Steam:

Adgang til private forummer

You'll want to have users login directly with their Steam account using OpenID. OpenID will return the user's 64bit SteamID which can then be used with ISteamUser/CheckAppOwnership to verify the user owns your appid. More details can be found above at Linking 3rd party accounts to Steam accounts.

Sådan låses der op for et ikke-Steam-spil, som er bygget uden DRM

Use OpenID and ISteamUser/CheckAppOwnership (documented above) to unlock the content on your own site. Alternatively, you could upload the DRM-free build as optional, free DLC.

Softwaren sælges på min egen hjemmeside og låses op med en nøgle

You'll want to have users login directly with their Steam account using OpenID. OpenID will return the user's 64bit SteamID which can then be used with ISteamUser/CheckAppOwnership to verify the user owns your appid. More details can be found in Tilknytning af tredjepartskonti til Steam-konti above.

Drop af genstande i spil til registrering af din tredjepartsnøgle

If you are using the Steam Inventory Service, make sure the item's itemdef is configured correctly as a promo item and call ISteamInventory::AddPromoItem from the client.
If you have your own item backend, you can call ISteamUser::GetAuthSessionTicket from the game client and then use ISteamUserAuth/AuthenticateUserTicket with ISteamUser/CheckAppOwnership to verify ownership. More Information...

Nøglen kontrollerer, hvilken version af softvaren der bliver låst op for

Each version of your game should have its own AppID. From the game client, call ISteamUser::GetAuthSessionTicket and then use ISteamUserAuth/AuthenticateUserTicket with ISteamUser/CheckAppOwnership to verify ownership. More Information...