Apple iCloud app password doesn't work

kaczkalolo commented 2 years ago

The problem

When i try to setup icloud integration using APP SPECIFIC PASSWORD it just will not log me in. Using regular credentials and 2fa does log in but with that i'm getting emails from apple about logging in to my account...

What is version of Home Assistant Core has the issue?

core-2021.9.6

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant OS

Integration causing the issue

No response

Link to integration documentation on our website

No response

Example YAML snippet

No response

Anything in the logs that might be useful for us?

No response

Additional information

No response

probot-home-assistant[bot] commented 2 years ago

icloud documentation icloud source _{^{(message by IssueLinks)}}

probot-home-assistant[bot] commented 2 years ago

Hey there @quentame, @nzapponi, mind taking a look at this issue as it has been labeled with an integration (icloud) you are listed as a code owner for? Thanks! _{^{(message by CodeOwnersMention)}}

FabioEight commented 2 years ago

Same issue detected:

`Logger: homeassistant.components.icloud.config_flow Source: components/icloud/config_flow.py:122 Integration: Apple iCloud (documentation, issues) First occurred: 15:50:23 (4 occurrences) Last logged: 16:02:32

Error logging into iCloud service: ('Invalid authentication token.', PyiCloudAPIResponseException('Missing apple_id field'))`

tismofied commented 2 years ago

I started having this issue as well. If I use app password I get " unknown error occurred" but if I use my icloud account password it works fine

kaczkalolo commented 2 years ago

It works fine but only for some time...

On Thu, 21 Oct 2021 at 14:55 tismofied @.***> wrote:

I started having this issue as well. If I use app password I get " unknown error occurred" but if I use my icloud account password it works fine

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/home-assistant/core/issues/57645#issuecomment-948587491, or unsubscribe https://github.com/notifications/unsubscribe-auth/ALII6UBJUGBPYO6PL64J6ODUIAEVBANCNFSM5F6ZLNYA . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

-- Pozdrawiam Kaczmarski Krystian

rasmusbe commented 2 years ago

Same problem here

2021-11-02 20:42:33 ERROR (MainThread) [homeassistant.components.icloud.config_flow] Error logging into iCloud service: ('Invalid authentication token.', PyiCloudAPIResponseException('Authentication required for Account. (421)'))

deltazerorsan commented 2 years ago

Yea, same here with two different Apple accounts. Both works with the account password but not with the APP SPECIFIC PASSWORD.

Rom

Shadewing666 commented 2 years ago

Slightly different problem from what this seems to be but I'm not sure if I should open a new issue.

When I use an App Specific Password during the add integration process, it asks for an "iCloud verification code", i.e. 2-factor authentication. But since I'm using an App Specific Password, the iCloud 2FA does not trigger.

bastianlemke commented 2 years ago

Same problem here ... I think this is a duplicate of #54473

chrismanivong commented 2 years ago

I think this is more a feature request, as the app-specific-password isn't implemented in this integration. In the app-specific password approach you need to name the application during technical logon together with your iCloud-username and the specific password. This integration is now working this way a.f.a.i.k. But It should do, to avoid problems with Apple on logging in as a non-human process.

github-actions[bot] commented 2 years ago

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates. Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

rasmusbe commented 2 years ago

Still an issue

chrismanivong commented 2 years ago

As underlying pyicloud uses just icloud web API, app specific passwords won't work. I investigated the documentation of pyicloud and for the time being, there is no possibility to get this working. I still had not found documentation of Apple about the authentication and logon method of app-specific passwords. Once I get ahead, I would be able to add this functionality to pyicloud and in that case to iCloud integration on Home Assistant.

github-actions[bot] commented 2 years ago

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates. Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

linust commented 2 years ago

I can confirm that the issue is still there in the latest HA release

GoState commented 2 years ago

I still cant use App Specific passwords either. Here is documentation from apple on how 3rd party apps should use this feature... really this integrations should NOT allow you to use your normal credentials and 2FA but the app specific password ( https://support.apple.com/en-us/HT204397 ). Using the app specific password keeps you from getting those emails from apple too (I use this approach with another add-on and never have the email issues).

Please fix this its been going on for a very long time.

icemanxbe commented 1 year ago

Still an issue.

Please update the integration to support app specific passwords.

maxistviews commented 1 year ago

Someone mentioned up top that app passwords cant work with the current integration, that's too bad - the documentation should reflect this.

jbmanwell commented 1 year ago

Still a problem. Bummer. Seems like a very important feature in terms of security

a1466d44-d3dc-4c0b-90c7-315b088731d7 commented 1 year ago

I'm only here to comment that I also just encountered this issue... If there is a way to help as a non python dev let me know

polskikrol commented 1 year ago

I have the same issue. One person suggested going through with full MFA w/ account password and then swapping out the password with the app password once the entities are setup via the config file at .storage/core.config_entries. However, this does not work. Once the session cookie times out, which btw is valid and survives a service restart of HA, then we are back to being unable to auth with an error: ` Logger: pyicloud.base Source: components/icloud/account.py:137 First occurred: 9:32:12 AM (2 occurrences) Last logged: 9:32:12 AM

Authentication required for Account. (421)
Authentication required for Account. (450)

` Other integrations support app passwords, and this should be the standard in terms of security.

bcutter commented 1 year ago

So what are chances this behavior will actually change?

indomitableMan commented 1 year ago

I also have experienced this issue in Home Assistant 2023.1.7 - CalDAV is unable to authenticate with iCloud when using the app specific password. The ultimate error returned is:

File "/usr/local/lib/python3.9/site-packages/caldav/davclient.py", line 556, in request raise NotImplementedError("Auth method %s not supported yet" % auth_type) NotImplementedError: Auth method x-mobileme-authtoken not supported yet

dlasher commented 1 year ago

App-specific passwords need to be implemented in this integration:

will prevent the repeated (weekly) required re-auth
NOT using them prevents enabling healthy 2FA like Yubikey
iCloud accounts are constantly under attack. Using your main username/password, when app passwords are a feature, is unacceptable from a security-risk perspective.
It will stop the several-times-a-day "Your Apple ID was used to sign in to iCloud via a web browser" - emails. Simply filtering those is unacceptable, since you really WANT to know when your apple ID is used. Turning off the alarm isn't a fix.

maxistviews commented 1 year ago

I agree, but I always assumed it is a limitation of app passwords not providing the same account information. Is this not the case?

dlasher commented 1 year ago

I agree, but I always assumed it is a limitation of app passwords not providing the same account information. Is this not the case?

Fair question, unknown to me.

issue-triage-workflows[bot] commented 10 months ago

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates. Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

maxistviews commented 10 months ago

I believe that this has been updated. Last time I had the connection with iCloud break, the integration prompted me for a new code. We'll see if it keeps happening!

MrTomek commented 9 months ago

I have an Apple account with Yubico keys plugged in:

When I try to add iCloud intefrations to HA (I log in with my app password) it still asks me for a verification code, which I am not allowed to display because everything is done through Yubico keys.

When can we expect some progress ?

bcutter commented 9 months ago

When can we expect some progress ?

Please proof me wrong, but I tend to say: never. No one is willing or able to do something here "because Apple". It's just unusable (to me) and I personally consider this a non-stable integration as it comes with more negative side effects than actual benefits.

dlasher commented 9 months ago

.... It's just unusable (to me) and I personally consider this a non-stable integration as it comes with more negative side effects than actual benefits....

I would tend to agree for the following reasons:

Failure is silent. You stop getting updates to locations without ANY indication. "It's 3am, they are NOT still at work!"
continual re-auth required (lack of app password support)

issue-triage-workflows[bot] commented 6 months ago

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates. Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

dlasher commented 6 months ago

Superceded by : https://github.com/gcobb321/icloud3_v3

maxistviews commented 6 months ago

Yes and no. I am not interested in the advanced functionality that icloud3v3 provides - I would like this to keep working. I think its mostly working now, I still need to re-authenticate every once in a while and I wish there was a more direct way to do this - each time I do it, its a little bit of a guessing game - did it work? Will I need to enter my code this time? etc.

lor74 commented 6 months ago

Yes and no. I am not interested in the advanced functionality that icloud3v3 provides - I would like this to keep working. I think its mostly working now, I still need to re-authenticate every once in a while and I wish there was a more direct way to do this - each time I do it, its a little bit of a guessing game - did it work? Will I need to enter my code this time? etc.

I agree. Moreover the configuration of iCloudV3 is not so obvious.... a lot of parameters etc... Until last week I have used life360 integration, that probabily will never woks again, so now I have started to use this integration... at the beginning all works fine, and I was also able to get the app sepcific password working for a while. Now the specific password is not working and moreover even if the integration is started I got a lot of error messages

2024-01-06 12:12:11.467 ERROR (SyncWorker_0) [pyicloud.base] Authentication required for Account. (421)
2024-01-06 12:12:11.654 ERROR (SyncWorker_0) [pyicloud.base] Authentication required for Account. (450)
2024-01-06 12:12:11.654 ERROR (SyncWorker_0) [homeassistant.components.icloud.account] Unknown iCloud error: Authentication required for Account.

Can we have a chance of a review of this official integration?

issue-triage-workflows[bot] commented 3 months ago

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates. Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍 This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

FabioEight commented 3 months ago

Issue still present on 2024.4.0.

rcmaehl commented 1 week ago

I can confirm I was able to setup App-Specific Passwords for this Integration HomeAssistant. Can you all confirm that:

Your default 2FA/MFA is not currently set to a Security Token when setting up the App-Specific Password?
You're using the email selected as "Apple ID" from the Emails & Phone Numbers section of https://appleid.apple.com/account/manage/section/security?
You're using an Apple Device signed into the account that is/has connected to the same network as the HomeAssistant host?
You're able to sign into https://appleid.apple.com from a desktop web browser on the same network as the HomeAssistant host (and ideally create the App-Specific Password within that desktop web browser)?
You are polling iCloud no more than once every 60 seconds (I poll every 5 minutes) once setup?

andrey-yantsen commented 1 day ago

@rcmaehl I'm receiving the Invalid authentication error when trying to set up the integration using the App-Specific Password. Here's what I see in the logs:

Logger: homeassistant.components.icloud.config_flow
Source: components/icloud/config_flow.py:128
integration: Apple iCloud (documentation, issues)
First occurred: 11 July 2024 at 22:18:26 (4 occurrences)
Last logged: 11:05:42

Error logging into iCloud service: ('Invalid authentication token.', PyiCloudAPIResponseException('Missing apple_id field'))

It's the same error as reported previously here: https://github.com/home-assistant/core/issues/57645#issuecomment-946794267 🤷

As for your questions:

Your default 2FA/MFA is not currently set to a Security Token when setting up the App-Specific Password? Yes. I have only 1 trusted phone number & 5 trusted devices (and the OTP is delivered to the devices).
You're using the email selected as "Apple ID" from the Emails & Phone Numbers section of appleid.apple.com/account/manage/section/security? Yes
You're using an Apple Device signed into the account that is/has connected to the same network as the HomeAssistant host? Yes to both parts.
You're able to sign into appleid.apple.com from a desktop web browser on the same network as the HomeAssistant host (and ideally create the App-Specific Password within that desktop web browser)? Yes.
You are polling iCloud no more than once every 60 seconds (I poll every 5 minutes) once setup? No, since I can't finish the integration's initial setup 🤷

I hope this somehow helps. I'll be happy to assist with any required debugging.

home-assistant / core