Settings
Every setting of providers/Credential/settings.yml.
providers/Credential/settings.yml holds Credential's settings. Passwords and Brute-force protection explain how they work together.
scenario
registration
Takestrue or false
Defaulttrue
Affectswhether new players can register with Credential, and accounts can move to it
When false, a registration is refused with the provider's registration-disabled message.
Takestrue or false
Defaulttrue
Affectswhether a new player confirms their password by typing it a second time
credential
The rules every new password follows, at registration and with /changepassword. A rule set to 0 is not enforced. Spaces are never allowed.
Takesa non-negative integer
Default1
Affectshow many characters other than letters and digits a password needs
scenario:
registration:
enabled: true
requireRepeat: true
credential:
minLength: 8
maxLength: 64
minUpper: 1
minLower: 1
minNumber: 1
minSpecial: 1authentication.bruteforce
AdvancedCounts wrong passwords and locks the player out after too many. It follows the sentinel switch of Credential's entry in providers/providers.yml.
Takesa non-negative integer
Default5
Affectshow many wrong passwords are allowed within lockout.duration
0 turns the protection off.
Takestrue or false
Defaulttrue
Affectswhether reaching maxAttempts locks the player out
When false, wrong passwords are still counted and warned about, but nobody is locked out.
Advanced
Takesa positive duration
Default"5m"
Affectshow long a wrong password is counted, and how long a lockout lasts
A zero or negative duration stops counting wrong passwords.
Takestrue or false
Defaulttrue
Affectswhether a wrong password is answered with the number of attempts left
Takesan integer from 0 to 100
Default50
Affectsfrom which share of maxAttempts the warning is shown
With maxAttempts: 5 and 50, the warning starts at the third wrong password, which leaves two. Values outside 0 to 100 are treated as the nearest end.
Takestrue or false
Defaulttrue
Affectswhether /changepassword <current> <new> [repeat] requires the repeat argument
With true, a missing repeat counts as a mismatch. With false, repeat is optional, but a given one must match. The command's syntax does not change with this setting: remove [repeat] from the change-password usage in providers/Credential/commands.yml to stop offering it, as described for usage.
cryptography
How Credential hashes passwords. See Hashing.
Advanced
Takes"bcrypt" or "argon2", in any case
Default"bcrypt"
Affectshow new password hashes are made
Existing hashes keep working with the algorithm that made them. A blank or unknown value makes registrations and password changes fail.
bcrypt reads only the first 72 bytes of a password; anything after that is ignored. A character outside ASCII takes two to four bytes, so this can apply below maxLength. argon2 has no such limit.
Takestrue or false
Defaulttrue
Affectswhether a hash made with another algorithm is remade with algorithm when its player logs in successfully
Advanced
Takesa positive integer
Default12
Affectsthe work factor of new bcrypt hashes
Each step up doubles the time a hash takes, for logins and for guessing alike.
Advanced
Takesa positive integer
Default3
Affectsthe iterations of new Argon2id hashes
Advanced
Takesa positive integer
Default1
Affectsthe parallelism of new Argon2id hashes
Advanced
Takesa positive integer
Default65536
Affectsthe memory, in kilobytes, each new Argon2id hash uses
A value of 0 or lower in a cost setting makes hashing fail, and with it registrations and password changes.