Identica 3.0.0 fixes dozens of login, session and replication problems, reorganises the configuration into clear documents per area, and upgrades your 2.2.1 installation by itself on the first start.

Highlights

• Fewer ways for a login to go wrong. Login progress stays with the connection that made it, so a second client under the same name can't take over a login in progress; while one connection logs in, others under its name are asked to try again shortly. Commands typed before their prompt are kept, authenticator codes work only once, and provider denials such as lockouts can't be bypassed through another provider.
• Sessions and replication hold up across proxies. An account has one active session, and a crashed proxy's sessions end within 30 seconds. Two proxies writing the same login or session at the same moment no longer overwrite each other: the one that comes second disconnects its player with "Reconnect to try again." (engine.concurrentChangeKick). Prompts and registration work with Redis replication, and proxies sharing a database start and save together without failing.
• Configuration is split by area. Settings, engine, routing, username conflicts and each feature have their own document, and files carry a version, so Identica upgrades them itself, starting with your 2.2.1 configuration and database.
• Usernames are unique without regard to case. A player can't register alice while an account holds Alice, and a Credential player who registered as Alice and joins as alice logs in to the same account, with its password and UUID. Conflict rules decide who keeps a name when, for example, a premium owner joins under a name a Credential account holds.
• Providers are picked more reliably. A provider's hostname, a verified account link or a running migration decide the provider before name guesses do. Routing targets can follow the proxy's forced hosts, and Premium can detect premium clients by their profile (experimental, off by default).
• Statistics. Next to bStats, Identica sends anonymous statistics and error reports to FastStats, including logins by provider, 2FA adoption and client versions. Player names, unique ids and addresses are never sent.

Upgrading

• Before the first start: stop every proxy that uses the database and back up the database and the data directory. The first proxy to start brings both up to date.
• Versions: Identica upgrades from 2.2.1 and newer. On an older installation, start 2.2.1 once first. MySQL 8.0.19 or newer is required; on an older server Identica stops before it changes any table. MariaDB has no minimum version.
• Configuration: every setting, message and command you changed in 2.2.1 moves to the document that holds it now, and the files an upgrade changes are copied to .strata/backup/.
  • The provider files in providers/Credential/ and providers/Premium/ are not upgraded: a value whose name or place changed falls back to its default, so compare them with the provider pages.
  • Removed settings: connection.sessions.activeTtl (sessions now expire after replication.heartbeatTimeout once their proxy stops), a scenario's advanceLockTtl, and the advanceBusy and pipelineKick messages. The username synchronization failure is one message, pipeline.identity.synchronizationFailed, with the text of 2.2.1's authentication scenario.
  • An account has one session now, so the session concurrency policy ALLOW_MULTIPLE no longer exists. The upgrade turns it into REPLACE_EXISTING, in the settings and in a provider's session settings, so the newest login takes over; set REJECT_NEW to keep the first login instead.
• Usernames: accounts that already share a name in two cases keep logging in through their own providers; the oldest holds the name. The console lists them on each start and /identica admin username duplicates shows them; nothing has to be changed.
  • /identica credential register only creates new accounts: it no longer links Credential to an existing account, and it refuses a name any account holds, in any case and through any provider, naming that account. The new account gets the UUID reserved for its name with /identica admin reservation set, so accounts moved from another plugin can keep their UUIDs.
  • The conflict rules of 2.2.1 (format_display) have no counterpart. Identica replaces them with the new default rules and deletes providers/conflicts; set your own rules again in the new form. The messages pipeline.policy.conflictDenied and pipeline.policy.entrypointRequired are removed.
• Redis: delete the session keys of 2.2.1 before the first start (identica:sessions:* with the default key names), for example with redis-cli --scan --pattern 'identica:sessions:*' | xargs redis-cli del. This version stores sessions differently.
• Redis ACL: a Redis user with restricted commands needs evalsha and script as well, for the writes that only succeed over what was read.
• Statistics: turn FastStats off in plugins/faststats/config.properties; the Statistics page lists what is sent.

For addon developers

• Access: IdenticaAPI is an interface. Get it with IdenticaAPI.get(), or IdenticaAPI.whenReady(...) when your addon may start first: IdenticaAPI.getEventManager() becomes IdenticaAPI.get().getEventManager(), getService(...) became findService(...) returning an Optional, and getPresenceService() became getIdentityService().
• Startup: Identica starts in phases, and a RuntimeLifecycle names its StartupPhase. IdenticaBootstrappedEvent is called once the features have started; IdenticaReadyEvent at the end, once providers are loaded and connections are handled.
• Usernames: a username lives in its own table, read and changed through AccountUsernamePersistenceService (find, findHolder, setSource, rename), which replaces AccountUsernameStatePersistenceService, AccountUsernameHistoryPersistenceService and AccountPersistenceService.updateUsername. AccountService.create, AccountPersistenceService.create and rename return a UsernameWriteResult, and create takes the username's source and provider. AccountUsernameDuplicatePersistenceService lists shared names.
• Providers and conflicts: ProviderTrait is ProviderGuarantee, with OWNED_USERNAME for AUTHORITATIVE_USERNAME, and ProviderClaimOrigin.ENTRYPOINT is HOSTNAME. Conflicts are settled by ConflictService rules and registrable ConflictOutcomes, which a provider adds through IdenticaProvider.conflictOutcomes(); UsernameAssigner replaces UsernameConflictHandler, and the resolvers, guards and conflict types are gone.
• Sessions and logins: an account has one session: SessionConcurrencyPolicy.ALLOW_MULTIPLE and SessionService.findAllByUniqueId are gone. SessionService.open fails with ConcurrentSessionChangeException when another login of the account was opened in between. PipelineStateReference names a connection. UsernameHeldEvent and LoginSupersededEvent report refused and superseded logins. </content> </invoke>
• Replication: ReplicatedCache reads with a revision (read, returning Versioned) and writes or removes only over what was read (write, remove); a ReplicationAdapter implements compareAndPut and compareAndInvalidate. PipelineStateStore.save returns whether it saved, clear(reference, read) clears only the state that was read, and update is gone.

Changelog

What’s new

• Authentication: Introduced usernames unique without regard to case (#201)
• Configuration: Introduced upgrades of 2.2.1 configuration directories (#196)
• Database: Introduced upgrades of 2.2.1 databases (#182)
• Identity: Introduced username conflict rules on provider guarantees (#206)
• Premium: Introduced experimental detection of premium clients by their profile id (#134)
• Restriction: Introduced provider join restrictions that admins can switch with commands (#85)
• Routing: Introduced forced host support for routing targets (#145)
• Statistics: Introduced logins by provider, 2FA adoption and client version statistics (#171)
• Statistics: Introduced FastStats usage statistics and error reports next to bStats (#167)

Enhancements

• Configuration: Kept empty lists as written and introduced versioned upgrades with backups in .strata/backup (#122)
• Configuration: Moved sentinel settings into their own feature files (#106)
• Configuration: Moved verification and recognition settings into their own feature files (#102)
• Configuration: Split settings into separate settings, engine and routing files (#100)
• Database: Changed the proxy to download only the configured database's driver (#197)
• Database: Changed MySQL to require version 8.0.19 or newer (#181)
• Recognition: Moved the untrusted IP settings under recognition eligibility (#84)
• Sessions: Removed the ALLOW_MULTIPLE session policy and the unused pipelineConcurrencyPolicy setting (#210)
• Sessions: Replaced activeTtl with a heartbeat, so the sessions of a crashed proxy expire within 30 seconds (#142)

Fixes

• Authentication: Fixed a second connection taking over a login in progress (#207)
• Authentication: Fixed provider hostnames not picking their provider (#204)
• Authentication: Fixed commands typed before their prompt being ignored (#202)
• Authentication: Fixed provider denials such as lockouts being bypassed by another provider (#136)
• Commands: Fixed /identica admin reload reporting success without reloading anything (#154)
• Commands: Fixed /identica admin reservation having no effect and reserved UUIDs being ignored after account deletion (#159)
• Configuration: Fixed upgraded 2.2.1 configurations with the ALLOW_MULTIPLE session policy failing to load (#217)
• Credential: Fixed players being refused in another username case, and console registration ignoring reserved UUIDs or linking existing accounts (#163)
• Credential: Fixed typed passwords being stored with the pending login state, including in Redis (#143)
• Credential: Fixed /identica credential register leaving the player without an account (#108)
• Database: Fixed H2 refusing the data directory's relative file path (#153)
• Database: Fixed two proxies failing when they save the same player's data at once (#186)
• Database: Fixed database start-up messages missing from the proxy console (#184)
• Database: Fixed a broken persistence.yml starting Identica on an empty SQLite database (#133)
• Database: Fixed proxies failing to start when they create the schema at the same time (#123)
• Messages: Fixed emptied messages turning off the action they belong to (#128)
• Migration: Fixed migration commands missing a journey a running pipeline holds (#205)
• Migration: Fixed moving a Premium account to Credential being cancelled on rejoin (#137)
• Platform: Fixed Velocity ignoring a join refusal at the profile stage (#156)
• Platform: Fixed players joining without authentication when Identica fails to start (#121)
• Premium: Fixed an offline player taking a username owned by a Premium account after a failed premium login (#161)
• Replication: Refused writes over a value that changed since it was read (#150)
• Replication: Fixed registration failing at /passconfirm when Redis replication is enabled (#120)
• Replication: Fixed players getting no login or register prompt when Redis replication is enabled (#119)
• Routing: Fixed scenario messages for a missing routing server being ignored (#194)
• Routing: Fixed login and registration messages not being sent without a completion target (#131)
• Sessions: Fixed logins through another proxy ignoring the concurrency policy and disconnecting the wrong connection (#138)
• Verification: Fixed authenticator codes being accepted more than once (#195)

Dependencies

• Platform: Updated Attache to 1.0.0, so Identica starts without access to Maven Central (#135)

For developers

• API: Introduced Dialectica entity access to Identica's database for addons (#193)
• API: Introduced pending scenario lookup, config catalog, reload event and login command marking for addons (#173)
• API: Replaced the scenario start events with Required and Resolved events per scenario (#89)
• API: Started Identica in phases declared by its runtime lifecycles (#188)
• API: Moved persistence contracts to the persistence package (#177)
• API: Changed IdenticaAPI into an interface with static access to the running instance (#174)
• API: Replaced schema contributors with database schemas installed through migrations (#170)
• API: Reworked pipeline state into typed state keys (#147)
• API: Gave handshake policies the known account and journey mode (#139)
• API: Moved PlatformType to the type.platform package (#88)

Full Changelog: https://github.com/whereareiam/Identica/compare/2.2.1...3.0.0

Support

If you need help with setup, configuration, or upgrades, join us on Discord. If you find a bug or want to suggest a feature, use GitHub.