Minecraft Auth

Nearata

Minecraft Auth

License Packagist Version

⚠️ WARNING

Do not use versions below 3.*. They are not safe to use.

Requirements

You need a Minecraft server with OAuth plugin installed.

Install

composer require nearata/flarum-ext-auth-minecraft

Remove

composer remove nearata/flarum-ext-auth-minecraft
php flarum cache:clear

How to use

You need to fill all the fields in Minecraft Auth admin settings page.

Minecraft Server IP

The Minecraft server IP that is using the OAuth plugin.

API URL

If for example you are running Flarum and the Minecraft Server on the same machine, you are free to use http://localhost:4567/verify. If the Minecraft Server is on a different machine, you need to update localhost with the public IP of that machine.

API Secret

The API secret can be found in the Plugins/OAuth/config.json file.

Links

Juba007

Awesome just waited for something like this.

TOWUK_ru

maybe custom server minecraft? not srv.mc-oauth.net...

Nearata

clarkwinkelmann

User39

TOWUK_ru

fixed in version 3.0.0. You now need to make your own minecraft server to let people oauth with their account.

User39

I tried to use this, but the server is offline!

Is there a way I can host this on my own server, or make my own OAuth server? This extension is perfect, but wary of when things like this break.

clarkwinkelmann

I assume you are referring to the mc-oauth.net service? I see that domain is indeed expiring (Expired May 2022, still in pending delete status). Once it becomes available it could be grabbed by a bad actor and make any website using it vulnerable to account takeover, so I would recommend removing this extension from any forum that still uses it.

I see there's a mc-oauth.com on the internet, but I have no idea if it's the same service that migrated domain or another implementation of a similar concept.

I'm going to add the incompatible badge for now.

User39

clarkwinkelmann great information, will not use until it's been fixed!

User39

Nearata hey a couple of questions:

If I stopped using this plugin and extension, would existing accounts on the forum be able to function? If not, how could I remedy this if I needed to not use it for any reason?
And for the server, would it be https://<website url>:4567/verify or should this be something else?
For the OAuth key I assume is in the Minecraft plugin folder, but please advise if it is not.

Happy to do testing soon!

Nearata

User39 If I stopped using this plugin and extension, would existing accounts on the forum be able to function? If not, how could I remedy this if I needed to not use it for any reason?

no, users who register an account with Minecraft can't change email and password. The use case of this extension implies that you close public registration and keep only this as the only OAuth for the users. So, this implies as such that you write extensions that depend on this one.

User39 And for the server, would it be https://<website url>:4567/verify or should this be something else?

If you are running the Minecraft server on the same machine of the forum, replace <website url> with localhost.
Example: you buy a dedicated server and setup both Flarum and a Minecraft server on it, that's the same machine.

User39 For the OAuth key I assume is in the Minecraft plugin folder, but please advise if it is not.

If for OAuth key you mean the secret code yes, that's in the config.yml file and is generated on the first run of the plugin.

If you are in need of a custom extension, you can open a discussion in

https://discuss.flarum.org/t/services - paid jobs
https://discuss.flarum.org/t/extension-proposals - free / paid / idk

User39

@Nearata thanks for the detailed response. If this extension were to go unsupported at some point, what would be the recourse for accounts created? Jus to confirm – would users need to abandon their accounts, and insated, create new ones?

Nearata

User39 would users need to abandon their accounts, and insated, create new ones?

yes.

The reason of it is because you can't know the email of a Minecraft account when they login your server, so i put a fake email in the email field, on register. (this is also another reason why you can't change email)

User39

Nearata I imagine I could go in and manually change the emails, and ask everyone to reset them, from the admin panel?

Nearata

User39 change email to what? if you disable this extension, the only way for the user to login is to reset the password. But because there's a fake email into their account, they can't.

User39

Nearata in the admin panel enter the real email of X user if I ask them, then they could reset the password I’d imagine.

Nearata

User39 yes, in the admin panel, as admin user, you can change their email and password.

User39

Nearata very confused. I set things up, but the only thing that happens is, on login, it will say "You have X seconds to login" and it counts down, and then resets. When I try to login to the website using the extension, it tells me to join the game. But I can't join the game lol... hmmm

Could it be that I am running 1.19.2?
"1.18.2 is the only supported version for now."

And, do I need a separate server on which to run this? I cannot join my main server, and verify at the same time it seems like. Ideally, I'd like the main server people play on to also be able to verify users somehow.

Thx!