# How DD Poker Server Handles Player Registration and Authentication

> Discover how the DD Poker server handles player registration and authentication using the OnlineProfile model and service for secure email-based account management and login.

- Repository: [Doug Donohoe/ddpoker](https://github.com/dougdonohoe/ddpoker)
- Tags: how-to-guide
- Published: 2026-02-28

---

**The DD Poker server manages player accounts through the OnlineProfile model and OnlineProfileService, using email-based registration with server-generated passwords and simple credential matching for authentication.**

The open-source `dougdonohoe/ddpoker` repository implements a complete player management system for the DD Poker game server. This article examines the server-side implementation of player registration and authentication, referencing the actual source code in the `pokerserver` module.

## Registration Workflow in PokerServlet

Player registration originates at the servlet layer. In [`PokerServlet.java`](https://github.com/dougdonohoe/ddpoker/blob/main/PokerServlet.java), the private method `addOnlineProfile` orchestrates the entire registration flow when processing incoming `DDMessage` requests.

### Parsing and Validating Registration Requests

The registration process begins with request parsing and multi-layer validation. The server wraps the incoming `DDMessage` in an `OnlineMessage` to extract the `OnlineProfile` data.

First, the system validates the requested player name against a disallow list:

```java
// Validation checks in PokerServlet.addOnlineProfile()
if (!onlineProfileService.isNameValid(name)) {
    // Returns CAT_APPL_ERROR with msg.wanprofile.invalid
}

```

The `isNameValid` method consults the `DisallowedManager` to filter prohibited names. Next, the server enforces per-email account limits to prevent abuse.

### Creating the OnlineProfile

After validation passes, the server generates credentials and persists the account. The `OnlineProfileService` creates a random password using `generatePassword()`, then constructs the profile with `activated = false` and the client's license key.

```java
// Profile creation sequence in PokerServlet.java (lines 720-747)
String generatedPassword = onlineProfileService.generatePassword();
profile.setPassword(generatedPassword);
profile.setLicenseKey(ddreceived.getKey());
profile.setActivated(false);

if (onlineProfileService.saveOnlineProfile(profile)) {
    // Success: email the generated password
    sendProfileEmail(postalService, "profile", 
                    profile.getEmail(), profile.getName(),
                    generatedPassword, null);
    resMsg = new OnlineMessage(ddreceived.getCategory());
} else {
    // Duplicate name detected
    resMsg = new OnlineMessage(DDMessage.CAT_APPL_ERROR);
    resMsg.setApplicationErrorMessage(
        PropertyConfig.getMessage("msg.wanprofile.duplicate", profile.getName()));
}

```

The `saveOnlineProfile` method returns **false** if a duplicate name exists, triggering an error response with category `CAT_APPL_ERROR` and message key `msg.wanprofile.duplicate`.

## Authentication Implementation

The DD Poker server uses a straightforward credential-matching approach for authentication, implemented in the service layer and consumed by both web interfaces and API endpoints.

### Core Authentication Logic

The `OnlineProfileServiceImpl` class provides the primary authentication method:

```java
// OnlineProfileServiceImpl.java (lines 66-74)
@Transactional(readOnly = true)
public OnlineProfile authenticateOnlineProfile(OnlineProfile profile) {
    OnlineProfile lookup = getOnlineProfileByName(profile.getName());
    if (lookup != null && (lookup.getPassword().equals(profile.getPassword())
            && !lookup.isRetired())) {
        return lookup;  // Success: return fully-loaded profile
    }
    return null;        // Authentication failed
}

```

This method performs three critical checks:
- **Name lookup**: Retrieves the profile using `getOnlineProfileByName`
- **Password verification**: Compares the supplied password with the stored value (plain-text for legacy compatibility)
- **Status check**: Ensures `!lookup.isRetired()` returns true, blocking deactivated accounts

### Web UI and API Authentication

Authentication serves dual purposes across the application architecture.

**Web Interface Login**: The Wicket-based web UI utilizes [`MyProfile.java`](https://github.com/dougdonohoe/ddpoker/blob/main/MyProfile.java) (lines 176-178) to authenticate users:

```java
// Web login flow in MyProfile.java
OnlineProfile auth = new OnlineProfile();
auth.setName(username);
auth.setPassword(password);
OnlineProfile profile = profileService.authenticateOnlineProfile(auth);
if (profile != null) {
    // Login succeeded: store profile in session
} else {
    // Display login error
}

```

**WAN Game Operations**: For API calls such as `addWanGame` and `getWanGames`, the servlet extracts authentication credentials from a `wanAuth` map in the request, wraps them in an `OnlineProfile` object, and validates them via `onlineProfileService.authenticateOnlineProfile` (lines 504-510 in [`PokerServlet.java`](https://github.com/dougdonohoe/ddpoker/blob/main/PokerServlet.java)). Failed authentication returns error codes including `msg.wanprofile.authfailed3` or `msg.wanprofile.authfailed`.

## Summary

- **Registration** occurs through `PokerServlet.addOnlineProfile`, which validates names against disallow lists, enforces email quotas, generates random passwords, and persists profiles via `OnlineProfileService`.
- **Persistence** returns boolean status indicating duplicate name conflicts, with email notifications sent only upon successful creation.
- **Authentication** relies on `OnlineProfileServiceImpl.authenticateOnlineProfile`, which verifies name-password matches and active account status in a read-only transaction.
- **Dual consumption** allows both the Wicket web interface ([`MyProfile.java`](https://github.com/dougdonohoe/ddpoker/blob/main/MyProfile.java)) and WAN game API endpoints to utilize the same authentication service.

## Frequently Asked Questions

### How does the server validate player names during registration?

The server calls `onlineProfileService.isNameValid(name)`, which checks the submitted name against the `DisallowedManager` list of prohibited names. If validation fails, the servlet returns a `DDMessage` with category `CAT_APPL_ERROR` and the message key `msg.wanprofile.invalid`.

### What happens if a duplicate player name is submitted?

The `saveOnlineProfile` method returns **false** when attempting to insert a profile with an existing name. The servlet catches this result and returns an error message using key `msg.wanprofile.duplicate` with the requested name as a parameter, preventing duplicate accounts.

### How are passwords stored and verified?

Passwords are stored in plain text within the `OnlineProfile` entity (legacy implementation). During authentication in `OnlineProfileServiceImpl`, the system uses `lookup.getPassword().equals(profile.getPassword())` for verification. The server generates random passwords during registration using `generatePassword()` and emails them to the user.

### Where is authentication enforced for WAN game operations?

WAN-related endpoints in [`PokerServlet.java`](https://github.com/dougdonohoe/ddpoker/blob/main/PokerServlet.java) (including `addWanGame` and `getWanGames`) extract credentials from the `wanAuth` request parameter, construct a temporary `OnlineProfile`, and call `onlineProfileService.authenticateOnlineProfile`. Failure results in error responses with keys like `msg.wanprofile.authfailed3` or `msg.wanprofile.authfailed`.