- 397
- IGN
- Telesphoreo
Hello everyone,
We are working on bringing back the server and making lots of changes. The first change is cracked mode and Eagler support. To facilitate this, we have a new system. This system is called Shibboleth IdP, which is an identity provider and broker. It facilitates handling UUIDs and verification at the proxy level. This is a complex system, so I will document how it works.
Firstly, the differentiator is cracked versus premium. A cracked username can join as any valid Mojang username. However, if it belongs to a premium account, the premium account can join at any time. The premium account replaces the cracked identity as the canonical owner. The old cracked UUID and its provider links are retired. Cracked clients may still use the username. If the premium owner has linked a factor, cracked clients must verify with that factor every time. Premium-only mode blocks cracked clients completely. The exception is if you are an admin. If you are a cracked admin, a premium player who joins as your username will NOT take precedence. This is to ensure that someone can't snipe a cracked admin's username and lock them out. The reason for this system is we want to prevent abuse and this was the best set of compromises.
In terms of who will be required to setup 2FA, admins are required (cracked and premium). Normal players (cracked and premium) can optionally do so. There are two providers that satisfy two factor. You can choose to link your Discord, XenForo, or Google account as a second factor. Additionally, if you are online as a premium account, you can lock your account to premium only logins. This means no cracked player can ever join as your username. The caveat to this is that if the Mojang authentication servers are down, you will not be allowed to connect.
As for when you'll be asked to login, it again depends on if you are cracked or premium. If you are a cracked player, you will need to login with a second factor every time you join (if you have set one up, of course, as it is optional). If you are a premium player, you will be asked to authenticate every time you join under a new IP address (also provided that you have setup two factor as it is optional for non-staff). If you do not join under an IP address for 30 days, it will be marked as expired and you will need to redo 2FA under that IP address once again.
This graph should hopefully explain it better:
FAQ:
Are you asking for my Microsoft username and/or password?
No. Not at all. This system does not request your username or password for your Microsoft account. Do not ever share your password with anyone. Staff members and server leadership will NEVER ask for your password. Shibboleth uses OAuth2 which verifies your identity with XenForo, Discord, and Google. Shibboleth never receives your Discord, XenForo, or Google password / browser session token. During the OAuth2 handshake, the provider gives Shibboleth a short-lived access token so it can read your stable account ID. That token is never persisted. Your stable account ID is persisted as we need it for subsequent authentication attempts.
Why such a complicated system?
It is complicated if you try and understand the whole picture. However, if you narrow it down to who you are, it becomes a lot easier to understand. I also had to build and design this system to assume the worst and most hostile users would interface with it and try and break it. There are a lot of typical shortcuts and naive assumptions that you can take. However, this was not an option for us given the target audience. The other reason is that I'm autistic as fuck about IAM, so there's that.
Do I have to use this system?
Only if you are a staff member. If you are a regular player, using it is completely optional (but recommended).
What if a premium player takes over my account?
This can only happen if you are a cracked non-staff member. A successfully Mojang-authenticated premium identity takes precedence over an ordinary cracked identity. The reason is that, for example, if StevenNL2000 joins as cracked and sets up 2FA, then the real StevenNL2000 could not join. Contrary, we don't want players to snipe cracked staff member usernames. So a premium username cannot take over a cracked staff account.
How often do I have to verify?
If you are cracked and have a factor linked, you must verify every time. If you are premium and have a factor linked, you must verify from every new IP address and again when an IP has not been used for 30 days. Premium-only players use Mojang authentication instead.
What if I'm a well known cracked non-admin and someone takes over my username to fuck with me?
On a case by case basis, server leadership can override the default behavior of a premium account taking precedence over the cracked account. With sufficient evidence provided of this happening to you, we can make it so your cracked username will take precedence over the premium account.
I saw a system different than the one you're describing!
This is a complex system, so if you are seeing something that does not match the documented behavior, do let me know. Note that due to a permission mess up, everyone was being asked to do 2FA. This has been corrected as of August 19th, 2026.
Does this change anything about the Plex HTTPD Module or TotalFreedom Wiki?
No. The HTTPD module still currently authenticates with XenForo only, however I plan to add Discord support for that as well. The TotalFreedom Wiki still only supports logging in using a XenForo account. We will not be switching either the HTTPD or TF Wiki to rely on Shibboleth. The reason is because as much as it does identity management, this is mostly related to in game identities, not identities over the web. Shibboleth acts as an identity provider between you, the proxy, and the servers, and a broker between you and your Discord, XenForo, and/or Google accounts.
How complex is this system?
Absurdly complex. Shibboleth is nearly 10,000 lines of custom code (while the platforms and protocol stacks beneath it collectively span millions) which is devoted to answering the apparently impossible question of whether Steve is actually Steve. Internally, it resembles a small government identity bureau trapped inside a Minecraft plugin. Fortunately, you do not need to understand any of it. Join the server, follow a verification link if one appears, and let Shibboleth experience the existential crisis for you.
Can it run Crysis?
Probably. At this point, I am more concerned that the authentication flow is accidentally Turing-complete. I refuse to check.
We are working on bringing back the server and making lots of changes. The first change is cracked mode and Eagler support. To facilitate this, we have a new system. This system is called Shibboleth IdP, which is an identity provider and broker. It facilitates handling UUIDs and verification at the proxy level. This is a complex system, so I will document how it works.
Firstly, the differentiator is cracked versus premium. A cracked username can join as any valid Mojang username. However, if it belongs to a premium account, the premium account can join at any time. The premium account replaces the cracked identity as the canonical owner. The old cracked UUID and its provider links are retired. Cracked clients may still use the username. If the premium owner has linked a factor, cracked clients must verify with that factor every time. Premium-only mode blocks cracked clients completely. The exception is if you are an admin. If you are a cracked admin, a premium player who joins as your username will NOT take precedence. This is to ensure that someone can't snipe a cracked admin's username and lock them out. The reason for this system is we want to prevent abuse and this was the best set of compromises.
In terms of who will be required to setup 2FA, admins are required (cracked and premium). Normal players (cracked and premium) can optionally do so. There are two providers that satisfy two factor. You can choose to link your Discord, XenForo, or Google account as a second factor. Additionally, if you are online as a premium account, you can lock your account to premium only logins. This means no cracked player can ever join as your username. The caveat to this is that if the Mojang authentication servers are down, you will not be allowed to connect.
As for when you'll be asked to login, it again depends on if you are cracked or premium. If you are a cracked player, you will need to login with a second factor every time you join (if you have set one up, of course, as it is optional). If you are a premium player, you will be asked to authenticate every time you join under a new IP address (also provided that you have setup two factor as it is optional for non-staff). If you do not join under an IP address for 30 days, it will be marked as expired and you will need to redo 2FA under that IP address once again.
This graph should hopefully explain it better:
FAQ:
Are you asking for my Microsoft username and/or password?
No. Not at all. This system does not request your username or password for your Microsoft account. Do not ever share your password with anyone. Staff members and server leadership will NEVER ask for your password. Shibboleth uses OAuth2 which verifies your identity with XenForo, Discord, and Google. Shibboleth never receives your Discord, XenForo, or Google password / browser session token. During the OAuth2 handshake, the provider gives Shibboleth a short-lived access token so it can read your stable account ID. That token is never persisted. Your stable account ID is persisted as we need it for subsequent authentication attempts.
Why such a complicated system?
It is complicated if you try and understand the whole picture. However, if you narrow it down to who you are, it becomes a lot easier to understand. I also had to build and design this system to assume the worst and most hostile users would interface with it and try and break it. There are a lot of typical shortcuts and naive assumptions that you can take. However, this was not an option for us given the target audience. The other reason is that I'm autistic as fuck about IAM, so there's that.
Do I have to use this system?
Only if you are a staff member. If you are a regular player, using it is completely optional (but recommended).
What if a premium player takes over my account?
This can only happen if you are a cracked non-staff member. A successfully Mojang-authenticated premium identity takes precedence over an ordinary cracked identity. The reason is that, for example, if StevenNL2000 joins as cracked and sets up 2FA, then the real StevenNL2000 could not join. Contrary, we don't want players to snipe cracked staff member usernames. So a premium username cannot take over a cracked staff account.
How often do I have to verify?
If you are cracked and have a factor linked, you must verify every time. If you are premium and have a factor linked, you must verify from every new IP address and again when an IP has not been used for 30 days. Premium-only players use Mojang authentication instead.
What if I'm a well known cracked non-admin and someone takes over my username to fuck with me?
On a case by case basis, server leadership can override the default behavior of a premium account taking precedence over the cracked account. With sufficient evidence provided of this happening to you, we can make it so your cracked username will take precedence over the premium account.
I saw a system different than the one you're describing!
This is a complex system, so if you are seeing something that does not match the documented behavior, do let me know. Note that due to a permission mess up, everyone was being asked to do 2FA. This has been corrected as of August 19th, 2026.
Does this change anything about the Plex HTTPD Module or TotalFreedom Wiki?
No. The HTTPD module still currently authenticates with XenForo only, however I plan to add Discord support for that as well. The TotalFreedom Wiki still only supports logging in using a XenForo account. We will not be switching either the HTTPD or TF Wiki to rely on Shibboleth. The reason is because as much as it does identity management, this is mostly related to in game identities, not identities over the web. Shibboleth acts as an identity provider between you, the proxy, and the servers, and a broker between you and your Discord, XenForo, and/or Google accounts.
How complex is this system?
Absurdly complex. Shibboleth is nearly 10,000 lines of custom code (while the platforms and protocol stacks beneath it collectively span millions) which is devoted to answering the apparently impossible question of whether Steve is actually Steve. Internally, it resembles a small government identity bureau trapped inside a Minecraft plugin. Fortunately, you do not need to understand any of it. Join the server, follow a verification link if one appears, and let Shibboleth experience the existential crisis for you.
Can it run Crysis?
Probably. At this point, I am more concerned that the authentication flow is accidentally Turing-complete. I refuse to check.
Last edited:
