Refresh token expires often

peternorlander commented 2 years ago

Hi!

I really like this integration but I wanted to ask. I don't know if it is just me but how often do you guys need to create a new token? Mine usually only last for maybe two weeks then I need to get a new one.

Regards Peter

Floppe commented 2 years ago

Hi. Have no idea how often, but it's so often that it's annoying. I've stopped using this integration until proper OAuth is implemented.

I've also noticed the same thing with Grohes own Android App. Have to sign in again after some weeks. So could be the problems are coming from their own services.

// Joachim

peternorlander commented 2 years ago

I spent a little time trying to understand how Grohe's OAuth is working using postman but can't really get it to work. Even when I copied the urls chrome is using with the same payloads I get errors that I'm using an outdated browser. Anyone has any idea how to make OAuth working?

seranoo commented 2 years ago

Hi!

I have the same issues, like every two weeks i need to generate a new token. And more or less the same issue with the Apple app, often need to delete/reinstall the app to get it working again.

It is such a pity, the combination with Grohe Sense and my home alarm is essentially why I started the whole HA "trip". I will have to find some other hardware that can accomplish a similar functionality.

Regards, Magnus

erikkt commented 2 years ago

I've had to modify mine. I have installed an Wemos ESP relay board inside the Grohe Sense Guard. It was an easy hack. Now I have at least a reliable way of shutting the water off.

seranoo commented 2 years ago

Do you run the Wemos ESP relay board in parallell with the Grohe Sense Guard functionality? I.e. can the Grohe Sense Guard automatically shut off the water in case of an unexpected high flow, etc?

And of course, do you have any photos of the hack? Would love to have some pointers.

erikkt commented 2 years ago

Yes, the Grohe functionality is unaffected (when it actually works...) There are solder points where the power cable attaches and where the solenoid valve attaches. If you with a wemos relay short circuit the negative from power to the negative on the solenoid, the solenoid will activate. You have 12v power already present there, so you need a wemos mini with relay card, and a small 12v->5v converter. Then you only need three wires between the wemos setup and the Sense guard, 12v + and -, and negative from relay to solenoid. Using ESPHome the code is super simple, and very reliable. And best of all, it is cloud independent.

seranoo commented 2 years ago

Wow!!! Thanks erikkt! Then that is exactly what I will do!

In my opinion the "local Grohe functionality" appears working well. I've got kids that once in a while forgets to completely turn off the tap, and the the Grohe Sense Guard always turns off the water. At least in my experience. I think is is just the cloud connection that really sucks.

Again, thanks for this!

bendikrb commented 2 years ago

I threw together some code to retrieve the token. Hopefully this could help integrating authentication in the HA integration!

""" """
import html
import json
import re
import sys
from urllib.parse import urlparse

import requests

BASE_URL = 'https://idp2-apigw.cloud.grohe.com/v3/iot/'
LOGIN_URL = f"{BASE_URL}oidc/login"

def main():
    args = [arg for arg in sys.argv[1:]]
    if len(args) < 2:
        raise ValueError("Need exactly 2 arguments: username, password")
    login(args[0], args[1])

def login(username, password):
    oauth_session = requests.Session()

    redirect = oauth_session.get(LOGIN_URL, allow_redirects=False)
    redirect.raise_for_status()

    login_url = redirect.headers['Location']
    login_form = oauth_session.get(login_url)
    login_form.raise_for_status()

    regex = r'action="([^ >"]*)"'
    matches = re.findall(regex, login_form.content.decode('utf-8'), re.MULTILINE)
    login_url = html.unescape(matches[0])

    response = oauth_session.post(
        login_url,
        allow_redirects=False,
        data={
            "username": username,
            "password": password,
        })
    response.raise_for_status()

    token_url = urlparse(response.next.url)._replace(scheme="https").geturl()
    token_result = oauth_session.get(token_url)
    token_result.raise_for_status()
    token = token_result.json()
    print("== Successfully retrieved access token ==")
    print(json.dumps(token, indent=4))

if __name__ == '__main__':
    main()