I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative to creating a domain specific account. I'm curious if I can use the Flash SDK for Facebook to indirectly authenticate a user on the Photon Server application.
I can leverage message encryption using the Photon Server framework. The users are linked to game accounts using an inherited entity derived from an abstract PlayerData class in a server-side Entity Framework model. This entity contains the information for Facebook authentication.
Can third-party authentication be done safely by forwarding the encrypted user access token and user id to the server from the Flash client, after authenticating with the Flash API for Facebook?
What methods are available for determining that the Facebook credential are still active, so that the client can be disconnected from the server should they log out of Facebook?