How DD Poker Server Handles Player Registration and Authentication

The DD Poker server manages player accounts through the OnlineProfile model and OnlineProfileService, using email-based registration with server-generated passwords and simple credential matching for authentication.

The open-source dougdonohoe/ddpoker repository implements a complete player management system for the DD Poker game server. This article examines the server-side implementation of player registration and authentication, referencing the actual source code in the pokerserver module.

Registration Workflow in PokerServlet

Player registration originates at the servlet layer. In PokerServlet.java, the private method addOnlineProfile orchestrates the entire registration flow when processing incoming DDMessage requests.

Parsing and Validating Registration Requests

The registration process begins with request parsing and multi-layer validation. The server wraps the incoming DDMessage in an OnlineMessage to extract the OnlineProfile data.

First, the system validates the requested player name against a disallow list:

// Validation checks in PokerServlet.addOnlineProfile()
if (!onlineProfileService.isNameValid(name)) {
    // Returns CAT_APPL_ERROR with msg.wanprofile.invalid
}

The isNameValid method consults the DisallowedManager to filter prohibited names. Next, the server enforces per-email account limits to prevent abuse.

Creating the OnlineProfile

After validation passes, the server generates credentials and persists the account. The OnlineProfileService creates a random password using generatePassword(), then constructs the profile with activated = false and the client's license key.

// Profile creation sequence in PokerServlet.java (lines 720-747)
String generatedPassword = onlineProfileService.generatePassword();
profile.setPassword(generatedPassword);
profile.setLicenseKey(ddreceived.getKey());
profile.setActivated(false);

if (onlineProfileService.saveOnlineProfile(profile)) {
    // Success: email the generated password
    sendProfileEmail(postalService, "profile", 
                    profile.getEmail(), profile.getName(),
                    generatedPassword, null);
    resMsg = new OnlineMessage(ddreceived.getCategory());
} else {
    // Duplicate name detected
    resMsg = new OnlineMessage(DDMessage.CAT_APPL_ERROR);
    resMsg.setApplicationErrorMessage(
        PropertyConfig.getMessage("msg.wanprofile.duplicate", profile.getName()));
}

The saveOnlineProfile method returns false if a duplicate name exists, triggering an error response with category CAT_APPL_ERROR and message key msg.wanprofile.duplicate.

Authentication Implementation

The DD Poker server uses a straightforward credential-matching approach for authentication, implemented in the service layer and consumed by both web interfaces and API endpoints.

Core Authentication Logic

The OnlineProfileServiceImpl class provides the primary authentication method:

// OnlineProfileServiceImpl.java (lines 66-74)
@Transactional(readOnly = true)
public OnlineProfile authenticateOnlineProfile(OnlineProfile profile) {
    OnlineProfile lookup = getOnlineProfileByName(profile.getName());
    if (lookup != null && (lookup.getPassword().equals(profile.getPassword())
            && !lookup.isRetired())) {
        return lookup;  // Success: return fully-loaded profile
    }
    return null;        // Authentication failed
}

This method performs three critical checks:

• Name lookup: Retrieves the profile using getOnlineProfileByName
• Password verification: Compares the supplied password with the stored value (plain-text for legacy compatibility)
• Status check: Ensures !lookup.isRetired() returns true, blocking deactivated accounts

Web UI and API Authentication

Authentication serves dual purposes across the application architecture.

Web Interface Login: The Wicket-based web UI utilizes MyProfile.java (lines 176-178) to authenticate users:

// Web login flow in MyProfile.java
OnlineProfile auth = new OnlineProfile();
auth.setName(username);
auth.setPassword(password);
OnlineProfile profile = profileService.authenticateOnlineProfile(auth);
if (profile != null) {
    // Login succeeded: store profile in session
} else {
    // Display login error
}

WAN Game Operations: For API calls such as addWanGame and getWanGames, the servlet extracts authentication credentials from a wanAuth map in the request, wraps them in an OnlineProfile object, and validates them via onlineProfileService.authenticateOnlineProfile (lines 504-510 in PokerServlet.java). Failed authentication returns error codes including msg.wanprofile.authfailed3 or msg.wanprofile.authfailed.

Summary

• Registration occurs through PokerServlet.addOnlineProfile, which validates names against disallow lists, enforces email quotas, generates random passwords, and persists profiles via OnlineProfileService.
• Persistence returns boolean status indicating duplicate name conflicts, with email notifications sent only upon successful creation.
• Authentication relies on OnlineProfileServiceImpl.authenticateOnlineProfile, which verifies name-password matches and active account status in a read-only transaction.
• Dual consumption allows both the Wicket web interface (MyProfile.java) and WAN game API endpoints to utilize the same authentication service.

Frequently Asked Questions

How does the server validate player names during registration?

The server calls onlineProfileService.isNameValid(name), which checks the submitted name against the DisallowedManager list of prohibited names. If validation fails, the servlet returns a DDMessage with category CAT_APPL_ERROR and the message key msg.wanprofile.invalid.

What happens if a duplicate player name is submitted?

The saveOnlineProfile method returns false when attempting to insert a profile with an existing name. The servlet catches this result and returns an error message using key msg.wanprofile.duplicate with the requested name as a parameter, preventing duplicate accounts.

How are passwords stored and verified?

Passwords are stored in plain text within the OnlineProfile entity (legacy implementation). During authentication in OnlineProfileServiceImpl, the system uses lookup.getPassword().equals(profile.getPassword()) for verification. The server generates random passwords during registration using generatePassword() and emails them to the user.

Where is authentication enforced for WAN game operations?

WAN-related endpoints in PokerServlet.java (including addWanGame and getWanGames) extract credentials from the wanAuth request parameter, construct a temporary OnlineProfile, and call onlineProfileService.authenticateOnlineProfile. Failure results in error responses with keys like msg.wanprofile.authfailed3 or msg.wanprofile.authfailed.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}