Games-Reborn / Auth System (IdP)

🔐 Games-Reborn Universal Identity Provider

Welcome to the Games-Reborn AuthServer. This is not just a login script; it is a full Identity Provider (IdP), built in C# .NET 8, capable of authenticating users across modern web apps, mobile apps, custom launchers, and legacy, unmodified game clients (like MU3 or NCSoft titles).

1. The Modern Flows (Web, App, and Launcher)

Located in UniversalAuthController.cs, these endpoints output highly secure JSON Web Tokens (JWT). These tokens can be verified universally by any game server in your cluster without hitting the database again.

Supported Authentication Methods:

  • Standard Credentials: POST /api/v1/auth/login (Standard Email/Password with bcrypt hashing).
  • Single Sign-On (SSO): POST /api/v1/auth/sso (Allows users to login via Google, GitHub, Apple, or Discord).
  • Passkeys (FIDO2 / WebAuthn): POST /api/v1/auth/passkey/verify (The future of passwordless logins. Users can use Windows Hello, FaceID, or TouchID on their phones to log into your games without ever typing a password).

Account Recovery & Security:

  • Email Restoration: POST /api/v1/auth/forgot-password generates a secure reset token and interfaces with EmailService.cs to dispatch a recovery link.
  • 2FA/MFA: Built into the universal model, the server can enforce Two-Factor Authentication via Authenticator Apps (TOTP) before issuing a session ticket.

2. The Legacy Bridge (MU3, NCSoft, etc.)

You asked for a system that can also work for MU3 and NCSoft games. Because we cannot alter the source code of those official clients, the AuthServer includes a Legacy Bridge (LegacyBridgeController.cs).

How it Works:

Commercial games hardcode their authentication URLs (e.g., MU3 contacts api.ourpalm.com/ucenter, NCSoft contacts ncauth.plaync.com). By using a proxy or a hosts file redirect, you point those domains to your AuthServer (Localhost:8080).

The Emulation Endpoints:

  • MU Origin 3 Emulation: The endpoint POST /ucenter/login catches the exact HTTP payload the MU3 client sends. Instead of throwing an error, it translates it. It issues a mock uid and a legacy SessionToken formatted exactly the way the Unreal Engine client expects, bypassing the DRM natively.
  • NCSoft Purple Emulation: The endpoint POST /ncAuth/v1/token catches requests from Lineage/Aion launchers, returning a simulated plaync_account_id payload.

3. The Cross-Platform Strategy

Because of this unified architecture, your ecosystem looks like this:

  1. The Web Dashboard: Uses standard JWTs to let players check stats or buy items in a browser.
  2. The Custom Launcher: Uses SSO (Login with Discord) to get a JWT.
  3. The Game Client (Modern): Your own Unity games verify the JWT against the GameServer directly.
  4. The Game Client (Emulated): MU3 boots up, hits the Legacy Bridge, and logs in seamlessly.

All four of these platforms pull from the exact same central UniversalAccount database. You have one master player list, one master ban list, and infinite possibilities.