search

MultiMC / Launcher

A custom launcher for Minecraft that allows you to easily manage multiple installations of Minecraft at once
https://multimc.org/
Other
4.2k stars 864 forks source link

Feature Request: Authlib Support #3394

Closed EdisonJwa closed 3 years ago

EdisonJwa commented 3 years ago

Authlib-injector is a modern authentication plugin which offers the following improvements:

  1. Features a more user-friendly interface (rather than the traditional in-game chating method (such as authme-reloaded) which require complex commands and requires a lot documentation for a new user to get started)
  2. Allow network-level authentication before the world is loaded (you don't need a queueing server anymore for large-scale servers that are always full)
  3. Provides the possibility to integrate with standard Single Sign-On methods (OAuth, etc.)
  4. provides better protection on server hacking/DoSing (the authentication service is out-of-band and it can allow that IP through the actual game server via external signaling)
Trumeet commented 3 years ago

Also, authlib-injector will provide connectivity and authentication for users in some countries or companies or institutions where the Mojang's official auth API is blocked.

peterix commented 3 years ago

Absolutely not. Auth is done in the launcher.

EdisonJwa commented 3 years ago

Absolutely not. Auth is done in the launcher.

This is just another way to let users to auth their accounts in the launcher

peterix commented 3 years ago
  1. Build your own Minecraft authentication system. implies not using Mojang services. It also implies piracy. This is not an option.
  2. MultiMC does not use Authlib and never will.
  3. Authlib will not be capable of doing MSA authentication in the future anyway, so all of this is basically deprecated at this point.
Jamesits commented 3 years ago

@peterix I understand your initial rejection concerning about functionality, complexity, possibility of piracy, etc., but we are just fellow developers tired of building (and teaching every user to use) complex login/register/recover password commands via the chat box and teleporting players around different servers using different mods and separate queueing servers. We are trying to achieve one thing -- authenticate users to the server -- using a more elegant method. Authlib-injector solves some problems that came with the Mojang binaries just like every other mod we use, and it has its own caveats just like every other mod we use. Here I'd like to try to explain some of your questions:

Build your own Minecraft authentication system. implies not using Mojang services. It also implies piracy. This is not an option.

On the topic of piracy, using homebrew auth system is just as bad as using the offline mode which is already an option.

MultiMC does not use Authlib and never will.

The "support" is basically:

  1. add a special type of plugin
  2. use a more flexible login form and pass a different login token to the Minecraft jar

This does not indicate the "use" of Authlib.

Authlib will not be capable of doing MSA authentication in the future anyway, so all of this is basically deprecated at this point.

Yes this is a valid claim; still there are a lot old versions that use the "legacy" Authlib and people will be playing them for a long time. And, speaking of being deprecated, is the whole Java version in the process of being deprecated and replaced by the C# version? But just as every long time player of Minecraft, you know what version is the one you really need. If one day the Java version of Minecraft is announced dead, at least we will still have an open-source version of the auth API server at home, powered by Authlib-injector.

Please reconsider this feature request.

kb-1000 commented 3 years ago

On the topic of piracy, using homebrew auth system is just as bad as using the offline mode which is already an option.

False.

You can only use offline mode when you have authenticated with a valid, "Premium" Mojang account before. Can you say the same about authlib-injector? Probably not.

Also there's no point in trying to convince a Mojang employee to support piracy.

peterix commented 3 years ago

The user is already authenticated by the launcher, which passes a signed token to the game, which then uses it to talk to Mojang services (not your services). I don't see the point of doing anything else.

peterix commented 3 years ago

Maybe if the company folds, nobody runs the services anymore and Minecraft becomes abandonware. This would be justified at that point.