two forms of authentication

Is running an online server with xAuth, AuthMe, or some other username/password plugin suggested? This would mean two layers of security for my server instead of one. Also, if minecraft.net goes down I can switch to a whitlisted, offline mode until it comes back up. Is this a good idea? Users would still have account integrity.

 

Sounds alright. I know Mojang sometimes take forever to bring the servers back online, so yeah whitelist + auth plugin in offline mode could work.

 

prompt set password on online mode only first time and prevent new accounts on offline mode would work good.

 

Is there an auto whitelist plugin that would work with this?

 

I'm not sure, but it would probably not be hard to make a plugin construct a whitelist from your AuthMe registered database.