mrletsplay2003 / shittyauthserver

Host your own (shitty) authentication server for Minecraft using the Yggdrasil authentication scheme

ShittyAuthServer

A shitty implementation of the Yggdrasil authentication scheme

This project implements Mojang's Yggdrasil authentication scheme (which was used before the transition to Microsoft accounts).

It is intended to be used in conjunction with the ShittyAuthLauncher

Compiling the server

The server uses Maven for building.

To compile the server, use

$ mvn package

which will generate a ShittyAuthServer-VERSION.jar in the target folder

Running the server

First, compile the server or download a prebuilt JAR file from here, then, run it using any Java 11+ VM.

Afterwards, navigate to http://your.server.ip:8880 in your web browser. You will be prompted to set up the WebinterfaceAPI server the authentication server uses.

Once you're done, your players will be able to create accounts (using password authentication) and use their credentials to login in the launcher (after having changing the auth server URL to the correct domain/IP).

Optional: If you have a setup using an HTTP(S) proxy server (e.g. Apache), make sure to change the Skin base URL in the Minecraft > Settings tab to your public domain.

shittyauthserver's Issues

SSL problems...

edit2: this issue should actually belong to MrLetsplay2003/SimpleHTTPServer since it is caused by the webserver.

Hello,
Trying around with this backend i discovered another failure,
When uploding a cetificate with multiple chained certificates in the cert file, the server will only take one of them to serve as certificate.
in my case it took the Certificate Authoritys chained(bundeled) certificate, which is ofcourse not valid for my domain.

this could be resolved, by either supporting the raw p7b file, or adding support for chained certificates.

example cert file:

1 s:/CN=domain.com
   i:/C=GB/ST=Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
RANDOMRANDOMsdkldfjhakjfhwkjfhkajhjkawhfklawjfklj==
-----END CERTIFICATE-----
2 s:/CN=domain-validation-CA.com
   i:/C=GB/ST=Domain Validation Secure Server CA
-----BEGIN CERTIFICATE-----
MIIGEzCCA/ugAwIBAgIQfVtRJrR2uhHbdBYLvFMNpzANBgkqhkiG9w0BAQwFADCB
iDELMAkGA1UEBSAJKDFHKJDFHKJDS&/§"Wh38ruusdf1aEn8=
-----END CERTIFICATE-----
3 s:/CN=CA
   i:/C=GB/ST=CA
-----BEGIN CERTIFICATE-----
MIIFgTTESTINGjCSADFhedhbfkjhASjdhTANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
MBkGAbg=
-----END CERTIFICATE-----
4 s:/C=GB/ST=CA Limited/CN=AAA Certificate Services
   i:/C=GB/ST=CA Limited/CN=AAA Certificate Services
-----BEGIN CERTIFICATE-----
7TESTINGjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
MBkGAbg==
-----END CERTIFICATE-----

output from shittyauth server:

4 s:/C=GB/ST=CA Limited/CN=AAA Certificate Services
   i:/C=GB/ST=CA Limited/CN=AAA Certificate Services
-----BEGIN CERTIFICATE-----
7TESTINGjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
MBkGAbg==
-----END CERTIFICATE-----

this results in a PKIX path building failed error since it cannot get the certs real chain, there are missing chain certificates.

EDIT:

The issue seems quite simple, the certificate is imported as .Der file which is, by its format, not able to hold more then one certificate. so to resolve the issue, the import function of the certificate should be using another format, supporting cert chains, ie p7b.

Problem when using authlib-injector on the client

Ich nehme mal an, dass ich es in deutsch beschreiben darf.

Also wenn ich den ShittyAuthLauncher benutze kann ich mich scheinbar erfolgreich mit meinem ShittyAuthServer verbinden.

Dann habe ich bei meiner Fork vom SKCraft Launcher die Adresse vom Yggdrasil Server zu der vom ShittyAuthServer geändert und ich kann mich erfolgreich mit einem Account anmelden. Mit authlib-injector als javaagent versuche ich nun den Client zu anzupassen doch das klappt nur mäßig und ich glaube, dass es am ShittyAuthServer liegt. Im WebInterface habe ich die authlib-injector-Unterstützung aktiviert (und neugestartet).

Ich bekomme beim starten vom Client folgenden Fehler:
[19:52:33] [Worker-Main-5/ERROR]: Failed to retrieve profile key pair com.mojang.authlib.exceptions.MinecraftClientException: Failed to read value <!DOCTYPE html><html><head><title>404 Not Found</title><meta name="description" content="404 Page" /><link rel="icon" href="/favicon.ico" /><meta name="viewport" content="width=device-width, initial-scale=1" /></head><body><h1>404 Not Found</h1><br /><i>/authserver/minecraftservices/player/certificates was not found on this server</i><br /><p style="font-size: 12px">SimpleHttpServer (Java)</p></body></html> at com.mojang.authlib.minecraft.client.ObjectMapper.readValue(ObjectMapper.java:29) ~[authlib-3.16.29.jar:?] at com.mojang.authlib.minecraft.client.MinecraftClient.readInputStream(MinecraftClient.java:84) ~[authlib-3.16.29.jar:?] at com.mojang.authlib.minecraft.client.MinecraftClient.post(MinecraftClient.java:55) ~[authlib-3.16.29.jar:?] at com.mojang.authlib.yggdrasil.YggdrasilUserApiService.getKeyPair(YggdrasilUserApiService.java:73) ~[authlib-3.16.29.jar:?] at net.minecraft.class_7434.method_43605(class_7434.java:130) ~[client-intermediary.jar:?] at net.minecraft.class_7434.method_44291(class_7434.java:79) ~[client-intermediary.jar:?] at java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1768) ~[?:?] at java.util.concurrent.CompletableFuture$AsyncSupply.exec(CompletableFuture.java:1760) ~[?:?] at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:373) ~[?:?] at java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1182) ~[?:?] at java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1655) ~[?:?] at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1622) ~[?:?] at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:165) ~[?:?] Caused by: com.google.gson.JsonSyntaxException: java.lang.IllegalStateException: Expected BEGIN_OBJECT but was STRING at line 1 column 1 path $ at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$Adapter.read(ReflectiveTypeAdapterFactory.java:395) ~[gson-2.10.jar:?] at com.google.gson.Gson.fromJson(Gson.java:1214) ~[gson-2.10.jar:?] at com.google.gson.Gson.fromJson(Gson.java:1124) ~[gson-2.10.jar:?] at com.google.gson.Gson.fromJson(Gson.java:1034) ~[gson-2.10.jar:?] at com.google.gson.Gson.fromJson(Gson.java:969) ~[gson-2.10.jar:?] at com.mojang.authlib.minecraft.client.ObjectMapper.readValue(ObjectMapper.java:27) ~[authlib-3.16.29.jar:?] ... 12 more Caused by: java.lang.IllegalStateException: Expected BEGIN_OBJECT but was STRING at line 1 column 1 path $ at com.google.gson.stream.JsonReader.beginObject(JsonReader.java:393) ~[gson-2.10.jar:?] at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$Adapter.read(ReflectiveTypeAdapterFactory.java:384) ~[gson-2.10.jar:?] at com.google.gson.Gson.fromJson(Gson.java:1214) ~[gson-2.10.jar:?] at com.google.gson.Gson.fromJson(Gson.java:1124) ~[gson-2.10.jar:?] at com.google.gson.Gson.fromJson(Gson.java:1034) ~[gson-2.10.jar:?] at com.google.gson.Gson.fromJson(Gson.java:969) ~[gson-2.10.jar:?] at com.mojang.authlib.minecraft.client.ObjectMapper.readValue(ObjectMapper.java:27) ~[authlib-3.16.29.jar:?] ... 12 more

Bis dahin klappt es aber scheinbar:
[19:49:54] [Render thread/INFO]: Environment: authHost='http://play.fridtjof.me:8880/authserver/authserver', accountsHost='http://play.fridtjof.me:8880/authserver/api', sessionHost='http://127.0.0.1:56653/https/sessionserver.mojang.com', servicesHost='http://127.0.0.1:56653/https/api.minecraftservices.com', name='PROD' [authlib-injector] [INFO] Transformed [com.mojang.authlib.yggdrasil.YggdrasilMinecraftSessionService] with [Texture Whitelist Transformer] [19:49:54] [Render thread/INFO]: Setting user: Fridtjof

authlib-injector setzte ich mit -javaagent:[...]/authlib-injector.jar=http://play.fridtjof.me:8880/authserver als Startparameter.

Welche Adresse ich für authlib-injector angeben muss, habe ich aus dem Quellcode entnommen, aber meine Javakenntnisse halten sich dann doch in Grenzen - Für sowas wäre eine umfangreichere Dokumentation hilfreich C:

Danke schon mal!

Compilation Failure

System OS Win11
Maven installed+added to path

It says that some plugins are missing
any help would be appriciated or a precompiled jar would be ok as well

Compilation issues again :>

so old compilation problem vanished but instead i get
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.8.1:compile (default-compile) on project
ShittyAuthServer: Fatal error compiling: invalid flag: --release -> [Help 1]

I have a problem

skins are not capture by minecraft even though i open an extra apache server

Sounds like an authorization issue?

I probably did something wrong during the installation, but I can not log into an already created account. It is also strange that after registration you are again asked for a username and password. Any ideas?
Another question, is it possible somehow in the future to translate text or change themes in WebInterfaceAPI without changing the library itself?

2023-07-14.17-54-37.mp4

Add API Documentation

I have the Server setup and ready to go, but cannot seem to use any launcher apart from yours. Trying to implement this server into another client using the authlib-injector seems to fail, can you document the API so we can Implement it into other launchers as well?

SSL Handshake termination, when downloading skin

I got it to work properly, but now i get this error when the client trys to download a skin:

[18:58:52] [Worker-Main-24/ERROR]: Couldn't download http texture
javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake
	at sun.security.ssl.SSLSocketImpl.handleEOF(SSLSocketImpl.java:1719) ~[?:?]
	at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1518) ~[?:?]
	at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425) ~[?:?]
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455) ~[?:?]
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426) ~[?:?]
	at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:580) ~[?:?]
	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:187) ~[?:?]
	at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:142) ~[?:?]
	at fnz.a(SourceFile:110) ~[1.19.3.jar:?]
	at java.util.concurrent.CompletableFuture$AsyncRun.run(CompletableFuture.java:1804) ~[?:?]
	at java.util.concurrent.CompletableFuture$AsyncRun.exec(CompletableFuture.java:1796) ~[?:?]
	at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:373) ~[?:?]
	at java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1182) ~[?:?]
	at java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1655) ~[?:?]
	at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1622) ~[?:?]
	at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:165) ~[?:?]
	Suppressed: java.net.SocketException: Eine bestehende Verbindung wurde softwaregesteuert
durch den Hostcomputer abgebrochen
		at sun.nio.ch.NioSocketImpl.implWrite(NioSocketImpl.java:420) ~[?:?]
		at sun.nio.ch.NioSocketImpl.write(NioSocketImpl.java:440) ~[?:?]
		at sun.nio.ch.NioSocketImpl$2.write(NioSocketImpl.java:826) ~[?:?]
		at java.net.Socket$SocketOutputStream.write(Socket.java:1035) ~[?:?]
		at sun.security.ssl.SSLSocketOutputRecord.encodeAlert(SSLSocketOutputRecord.java:81) ~[?:?]
		at sun.security.ssl.TransportContext.fatal(TransportContext.java:407) ~[?:?]
		at sun.security.ssl.TransportContext.fatal(TransportContext.java:314) ~[?:?]
		at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:467) ~[?:?]
		at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426) ~[?:?]
		at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:580) ~[?:?]
		at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:187) ~[?:?]
		at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:142) ~[?:?]
		at fnz.a(SourceFile:110) ~[1.19.3.jar:?]
		at java.util.concurrent.CompletableFuture$AsyncRun.run(CompletableFuture.java:1804) ~[?:?]
		at java.util.concurrent.CompletableFuture$AsyncRun.exec(CompletableFuture.java:1796) ~[?:?]
		at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:373) ~[?:?]
		at java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1182) ~[?:?]
		at java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1655) ~[?:?]
		at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1622) ~[?:?]
		at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:165) ~[?:?]
Caused by: java.io.EOFException: SSL peer shut down incorrectly
	at sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:489) ~[?:?]
	at sun.security.ssl.SSLSocketInputRecord.readHeader(SSLSocketInputRecord.java:478) ~[?:?]
	at sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:160) ~[?:?]
	at sun.security.ssl.SSLTransport.decode(SSLTransport.java:111) ~[?:?]
	at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510) ~[?:?]
	... 14 more

im unsure if this is caused by the server or the authlib,
how is the skin transmission working?
is it using the defined ssl cert or the generated one in the config folder?

Uploading a Skin is not possible

Problem:
When uploading a skin, i get Malformed request.

What i did yet:
Fresh setup with MariaDB, created admin account setup https -> working,
created minecraft account with admin account, uploaded skin -> malformed request
same when trying to upload a cape.
also tryed the same without ssl, same result.

backend log:

MoTTY X11 proxy: Unsupported authorisation protocol
java.lang.reflect.InvocationTargetException
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at me.mrletsplay.webinterfaceapi.page.action.ActionHandler.handle(ActionHandler.java:28)
        at me.mrletsplay.webinterfaceapi.page.action.WebinterfaceActionHandlers.handle(WebinterfaceActionHandlers.java:13)
        at me.mrletsplay.webinterfaceapi.document.FileUploadDocument.createContent(FileUploadDocument.java:47)
        at me.mrletsplay.simplehttpserver.http.HttpConnection.receive(HttpConnection.java:100)
        at me.mrletsplay.simplehttpserver.http.HttpConnection.lambda$startRecieving$0(HttpConnection.java:53)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.NoClassDefFoundError: Could not initialize class java.awt.GraphicsEnvironment$LocalGE
        at java.desktop/java.awt.GraphicsEnvironment.getLocalGraphicsEnvironment(GraphicsEnvironment.java:129)
        at java.desktop/java.awt.image.BufferedImage.createGraphics(BufferedImage.java:1181)
        at me.mrletsplay.shittyauth.webinterface.ShittyAuthWIHandler.uploadSkin(ShittyAuthWIHandler.java:64)
        ... 14 more
2023-01-31 17:44:06 [pool-3-thread-13 | Webinterface] ERROR: Malformed request
java.lang.reflect.InvocationTargetException: null
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at me.mrletsplay.webinterfaceapi.page.action.ActionHandler.handle(ActionHandler.java:28)
        at me.mrletsplay.webinterfaceapi.page.action.WebinterfaceActionHandlers.handle(WebinterfaceActionHandlers.java:13)
        at me.mrletsplay.webinterfaceapi.document.FileUploadDocument.createContent(FileUploadDocument.java:47)
        at me.mrletsplay.simplehttpserver.http.HttpConnection.receive(HttpConnection.java:100)
        at me.mrletsplay.simplehttpserver.http.HttpConnection.lambda$startRecieving$0(HttpConnection.java:53)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.NoClassDefFoundError: Could not initialize class java.awt.GraphicsEnvironment$LocalGE
        at java.desktop/java.awt.GraphicsEnvironment.getLocalGraphicsEnvironment(GraphicsEnvironment.java:129)
        at java.desktop/java.awt.image.BufferedImage.createGraphics(BufferedImage.java:1181)
        at me.mrletsplay.shittyauth.webinterface.ShittyAuthWIHandler.uploadSkin(ShittyAuthWIHandler.java:64)
        ... 14 common frames omitted

frontend (browser):

no errors in console,
seems like backend to me.

Changing a users forgotten pasword / reseting it in the webinterface.

As the title suggests, it would be very helpful to have the feature to set or reset a password for a specific user in the administration menu.

web interface

web interface nothing changed anything skin settings skin URL and add another login information

screenshots:

Random Server Crashes

Server Randomly Crashing when trying to login after restarting it, using MySQL as a Backend

After uploading a custom skin Specifically

Stack trace: java.lang.NullPointerException: Cannot invoke "me.mrletsplay.shittyauth.user.UserData.getSkinType()" because "d" is null me.mrletsplay.shittyauth.page.AccountPage.lambda$new$0(AccountPage.java:48) me.mrletsplay.webinterfaceapi.page.dynamic.DynamicMultiple.create(DynamicMultiple.java:13) me.mrletsplay.webinterfaceapi.page.dynamic.DynamicList.createObject(DynamicList.java:42) me.mrletsplay.webinterfaceapi.page.dynamic.DynamicList.lambda$create$0(DynamicList.java:35) java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273) java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625) java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509) java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499) java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921) java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682) me.mrletsplay.webinterfaceapi.page.dynamic.DynamicList.create(DynamicList.java:36) me.mrletsplay.webinterfaceapi.page.PageSection.toHtml(PageSection.java:146) me.mrletsplay.webinterfaceapi.page.Page.toHtml(Page.java:218) me.mrletsplay.webinterfaceapi.page.Page.createContent(Page.java:335) me.mrletsplay.shittyauth.page.AccountPage.createContent(AccountPage.java:129) me.mrletsplay.webinterfaceapi.document.HomeDocument.createContent(HomeDocument.java:18) me.mrletsplay.simplehttpserver.http.HttpConnection.receive(HttpConnection.java:100) me.mrletsplay.simplehttpserver.http.HttpConnection.lambda$startRecieving$0(HttpConnection.java:53) java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) java.base/java.lang.Thread.run(Thread.java:833)

Client crash because Server sends content length greater 0 in 204 response when using gzip or deflate

When using gzip compression, the auth server appends a "Content-Length" header with a value of 20 to the "204 No Content Response."
it causes the shittyauthclient to crash.

test curl command:
curl -X POST -d '{"accessToken":"52345234-b345f-4333-3330-e56fztuihjf","clientToken":"4fghfhsdrf-c9c5-44tr1-brgb-0rg5667dr445dfc"}' 'http://test.test/validate' -v -H "accept-encoding: gzip"
will retrurn a content length of 20

When requests are made through proxies, the traffic can potentially be compressed using standard HTTP compression methods such as gzip or deflate. However, if the server appends a content-length header to a 204 response, it can cause a client crash.