Custom Authentication and On-Premises server issues

Hi

We're currently evaluating photon server on an On-Premises machine (technically on fast-hosts, but the point is it isn't photon cloud!), probably intending to move to the enterprise cloud model later. I've been implementing custom authentication today and hit upon a brick wall, and am beginning to question whether it is even supposed to work with an on-premises setup.

I have what initially appeared to be a working system, with a node based server with an auth end point, which (simplified to remove the actual auth bit) looks like this:

        
        //endpoint for photon custom authentication. provides secret, account and token,
        //and expects back a response with a 'ResultCode' in, 0 meaning success
        this.router.get('/photon/auth',defaultauth,photonauth,(req,rsp) => {
            log.msg(`GET photon-auth account=${req.query.account}, token=${req.query.token}`);
		    rsp.send({ ResultCode: 0, UserId: req.query.account });
        })

and the server config has the correct AuthSettings enabled, pointing at the correct path.

The connection code that sets up the auth params is as follows:

        AuthenticationValues auth = new AuthenticationValues();
        auth.UserId = m_userid;
        auth.AddAuthParameter("account", m_userid);
        auth.AddAuthParameter("token", m_usertoken);
        auth.AuthType = CustomAuthenticationType.Custom;
        Connect(m_address, "our-photon-app-id", "1.0", m_nickname, auth);

I have verified that on connection my end point is called, the correct stuff is logged, and that by making my end point return { "ResultCode": 1 } I can prevent the client connecting, but by making it return { "ResultCode": 0 } I get a connection. In general, this all looks like it's working perfectly.

However, when I eventually go to call "OpJoinOrCreateRoom" on our version of the LoadBalancingClient, it receives:
[Photon] Op response op=226, ret=-3
Which I believe is authorisation failed when attempting to join game. It then simply sits in the "ConnectedToMasterServer" state forever.

I have verified it is ready before attempting to join, and (just to test it), tried leaving a 10s delay between successful connection and the join request, but the results point at a logic issue, not a timing one.

From staring at the load balancer code and some educated guessing, I get the impression our client is never receiving a token, which I believe is then required to connect to game servers. Certainly the Authenticate operation response is being received, but it does not contain a "ParameterCode.Secret" parameter.

Can anyone advise? Is this simply a photon cloud only feature? Is there some extra settings I have to configure for it to work on premises?

Thanks

Chris