[Suggestion] Provide real yggdrasil auth

[JackOfNoneTrades]

Ditching the old homemade auth system in favor of a more stable implementation.
There is a java yggdrasil library: https://github.com/Litarvan/OpenAuth
Dispatching and managing skins/capes, as I remember, was really a big hack. This would allow to hook into the native system and keep compat with many mods that use skins.
I haven't looked at this mods updates, if there are custom models or other things, they could be made as a superset of the yggdrasil protocol.
This would also make it possible for people with microsoft accounts to join, of course configurable.
Logging in with a public/private keypair can also probably easily be added ontop.

I could probably work on this in the future.

Note:
It is possible to mixin into authlib, offlineauth could become a much more convenient autlib injector alternative.

import com.mojang.authlib.GameProfile;
import com.mojang.authlib.yggdrasil.YggdrasilMinecraftSessionService;
import org.spongepowered.asm.mixin.Mixin;
import org.spongepowered.asm.mixin.injection.At;
import org.spongepowered.asm.mixin.injection.Inject;
import org.spongepowered.asm.mixin.injection.callback.CallbackInfoReturnable;

@Mixin(YggdrasilMinecraftSessionService.class)
public abstract class MixinTest {
    @Inject(method = "fillProfileProperties", at = @At("HEAD"), remap = false)
    private void onFillProfileProperties(GameProfile profile, boolean requireSecure, CallbackInfoReturnable<GameProfile> cir) {
        System.out.println("lol");
    }
}

[kotmatross28729]

Whoa, this is actually a big step in terms of development, I guess this should be looked into properly

Preface

1. I'm not sure I'll have time to implement this in the near future,
   but it's actually interesting to consider later

2. I have to admit, I initially forked this just for myself.
   And while I want to keep it in its current (familiar to me) form, I'm never against improving it

Regarding The Current System

• Skins are provided by the offlineauth system, which works very well
• Capes are unfortunately disabled by default (a bit buggy), instead we use the Customizable Player Models mod for them
• Registration system itself is almost identical to the original, only the whitespace inconsistency (displayname) bugs have been fixed, and a registration cooldown has also been added

Regarding skin support in other mods - yeah, it requires separate patches (see ServerUtilities, Tabfaces, BetterQuesting)

We do it through mixins, which is a fairly compatible way. And there aren't that many mods that require patches

While I'm 99% sure we can just do an early mixin into vanilla and resolve all these incompatibilities without explicit patches,
I'll look into it later

Regarding The Current System: 2

I had some experience with authlib injector, and I can say that it is a really good solution

However, I still prefer the current offlineauth approach, it's more... consistent?
I mean, with offlineauth you still only have 1 server and client, the entire database is on the main server,
and registration happens without leaving the game

I also like the approach where each server is its own authentication server,
so if you can connect to this server, then you can definitely connect to its authentication server

About Migration

I took a quick look at OpenAuth and here's what I can tell:

1. As far as I understand, there is no support for offline servers?
   So, if OpenAuth is going to be integrated, it needs to be supported for both offline and custom auth servers (and mojang (microsoft))

2. Also, for offline mode, in my current implementation
   I force server into offline mode.
   This is mostly to prevent UUID bugs (where mojang accounts change UUID when changing mode).
   And yeah, I know that for servers that want to switch to offlineauth, this will cause even more problems.
   However, if we want to implement OpenAuth, we must somehow solve this, because alternative auth services have their own way to calculate UUID

I'm also not sure how the registration cooldown system will work with alternative services.
Although (and most likely), third-party services already have something similar, and for personal ones you can write it yourself (if needed)

---

Phew, that seems to be it

I think this is a really great idea, although it's kinda difficult to implement

There should probably be some conclusion here, but that's where my vocabulary ends ¯\_(ツ)_/¯

[JackOfNoneTrades]

I should have looked better at OpenAuth. I thought it was an yggdrasil backend implementation, instead it is just a client.
My idea is to keep the OfflineAuth primary feature, but also to make it a better replacement for authlib injector, with everything being configurable. I'll work on this on a separate repo for now.