From 85414391b0069c8fd87a030e4dfdf667458c2971 Mon Sep 17 00:00:00 2001 From: Aryan Singh Date: Fri, 10 Jul 2026 12:34:02 -0500 Subject: [PATCH] Disable enforce-secure-profile so offline-launcher players can join EasyAuth flagged it at startup: with enforce-secure-profile on (vanilla default), TLauncher/offline clients are rejected before they can even authenticate. Set ENFORCE_SECURE_PROFILE=FALSE on the mc service and document the symptom in troubleshooting. Co-Authored-By: Claude Fable 5 --- docker-compose.yml | 5 ++++- docs/troubleshooting.md | 10 +++++++--- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 7264e78..87046ff 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -16,8 +16,11 @@ services: MEMORY: ${MC_MEMORY:-6G} USE_AIKAR_FLAGS: "true" - # Offline mode + whitelist as the approval gate (see docs/auth-flow.md) + # Offline mode + whitelist as the approval gate (see docs/auth-flow.md). + # enforce-secure-profile must be off or offline-launcher players are + # rejected before EasyAuth can even prompt them (EasyAuth issue #68). ONLINE_MODE: "FALSE" + ENFORCE_SECURE_PROFILE: "FALSE" ENABLE_WHITELIST: "TRUE" ENFORCE_WHITELIST: "TRUE" diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md index 8b79daa..88c5aa4 100644 --- a/docs/troubleshooting.md +++ b/docs/troubleshooting.md @@ -20,12 +20,16 @@ Work down this list: 1. **"Not whitelisted"** → their username isn't approved (or the window expired and auto-revoked them). Access & Auth → approve/re-open. Username must match **exactly** (case matters in TLauncher). -2. **Joins but immediately kicked** → they didn't `/register` or `/login` in time — +2. **Kicked with a "secure profile" / "invalid signature" style error** → + `enforce-secure-profile` must be `false` for offline launchers. The compose file + sets `ENFORCE_SECURE_PROFILE: "FALSE"`; if you edited `server.properties` by hand, + make sure `enforce-secure-profile=false`. +3. **Joins but immediately kicked** → they didn't `/register` or `/login` in time — EasyAuth kicks unauthenticated players after a timeout. Tell them to type faster or raise the timeout in `config/EasyAuth/`. -3. **"Connection timed out"** → networking: is 25565 port-forwarded? Are they using +4. **"Connection timed out"** → networking: is 25565 port-forwarded? Are they using your *public* IP? Does `docker compose ps` show `mc` healthy? -4. **Wrong password loop** → Access & Auth → **Reset password**, share the temporary +5. **Wrong password loop** → Access & Auth → **Reset password**, share the temporary one privately. ## Panel shows "Offline" but the server is up