401 response when authenticating with version 1.24.0

scttnlsn commented 4 weeks ago

Overview

401 response when authenticating with version 0.1.24

Steps to Reproduce

Install version 0.1.24
Run icloudpd --username '<email>' --password '<password>' --auth-only

Expected Behavior

Authentication succeeds.

Actual Behavior

Authentication fails with this error message:

pyicloud_ipd.exceptions.PyiCloudAPIResponseException: {
  "serviceErrors" : [ {
    "code" : "-20101",
    "message" : "Enter the email or phone number and password for your Apple Account.",
    "suppressDismissal" : false
  } ]
} (401)

Context

I was experiencing the authentication issues described in https://github.com/icloud-photos-downloader/icloud_photos_downloader/issues/970. Tried upgrading to 0.1.24 (which includes a fix for that) but I'm getting another authentication error.

Jan108 commented 4 weeks ago

I have the same problem, but I get a different error code from the API:

jan@jan:~/$ ./icloudpd-ex-1.24.0-linux-amd64 icloudpd --username '<iCloud email>' --auth-only
2024-10-26 13:46:24 DEBUG    Authenticating...
iCloud Password: 
Traceback (most recent call last):
  File "pyicloud_ipd/base.py", line 270, in authenticate
pyicloud_ipd.exceptions.PyiCloudAPIResponseException: {
  "serviceErrors" : [ {
    "code" : "-20283",
    "message" : "Enter the email or phone number and password for your Apple Account.",
    "suppressDismissal" : false
  } ]
} (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "starters/icloudpd_ex.py", line 122, in <module>
  File "starters/icloudpd_ex.py", line 118, in main
  File "click/core.py", line 1157, in __call__
  File "click/core.py", line 1078, in main
  File "click/core.py", line 1688, in invoke
  File "click/core.py", line 1434, in invoke
  File "click/core.py", line 783, in invoke
  File "icloudpd/base.py", line 745, in main
  File "icloudpd/base.py", line 1183, in core
  File "icloudpd/authentication.py", line 53, in authenticate_
  File "pyicloud_ipd/base.py", line 160, in __init__
  File "pyicloud_ipd/base.py", line 273, in authenticate
pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n  "serviceErrors" : [ {\n    "code" : "-20283",\n    "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n    "suppressDismissal" : false\n  } ]\n} (401)'))
[11451] Failed to execute script 'icloudpd_ex' due to unhandled exception!

version:1.24.0, commit sha:0e608f6, commit timestamp:Fri Oct 25 18:18:53 2024 CEST

AndreyNikiforov commented 4 weeks ago

The only ref to -20283 error code mentions app-specific password, which do not work for icloud photos. I have no clue what both of these codes mean.

General ideas to experiment with password issues:

remove cookies (~/.pyicloudpd by default)
remove pass from keyring with icloud or explicitly state --password-provider console --mfa-provider console
(do not use --password param to avoid char issues with the shell)

AndreyNikiforov commented 4 weeks ago

I checked that my account has app specific password from long ago and I am able to authenticate with regular password in 1.24.0

Jan108 commented 3 weeks ago

Cookie removal or explicitly setting the provider to console didn't help.

Setting a new password for the account solves the problem, I found the solution in this fastlane issue.

lvdgraaff commented 3 weeks ago

Cookie removal or explicitly setting the provider to console didn't help.

Setting a new password for the account solves the problem, I found the solution in this fastlane issue.

Thanks! I can confirm this solved the issue for me too. Same as the original poster in the linked issue, I used to have a very old (>10 y) password.

CreativePR commented 3 weeks ago

We are seeing this error as well with one of our users that has a more recently set password. Using the Windows version of 1.24.0. Here is the error generated:

Traceback (most recent call last): File "pyicloud_ipd\base.py", line 270, in authenticate pyicloud_ipd.exceptions.PyiCloudAPIResponseException: { "serviceErrors" : [ { "code" : "-20101", "message" : "Enter the email or phone number and password for your Apple Account.", "suppressDismissal" : false } ] } (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last): File "starters\icloudpd.py", line 6, in File "click\core.py", line 1157, in call File "click\core.py", line 1078, in main File "click\core.py", line 1434, in invoke File "click\core.py", line 783, in invoke File "icloudpd\base.py", line 745, in main File "icloudpd\base.py", line 1183, in core File "icloudpd\authentication.py", line 53, in authenticate_ File "pyicloud_ipd\base.py", line 160, in init File "pyicloud_ipd\base.py", line 273, in authenticate pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n "serviceErrors" : [ {\n "code" : "-20101",\n "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n "suppressDismissal" : false\n } ]\n} (401)')) [16804] Failed to execute script 'icloudpd' due to unhandled exception!

CreativePR commented 3 weeks ago

We are seeing this error as well with one of our users that has a more recently set password. Using the Windows version of 1.24.0. Here is the error generated:

Traceback (most recent call last): File "pyicloud_ipd\base.py", line 270, in authenticate pyicloud_ipd.exceptions.PyiCloudAPIResponseException: { "serviceErrors" : [ { "code" : "-20101", "message" : "Enter the email or phone number and password for your Apple Account.", "suppressDismissal" : false } ] } (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last): File "starters\icloudpd.py", line 6, in File "click\core.py", line 1157, in call File "click\core.py", line 1078, in main File "click\core.py", line 1434, in invoke File "click\core.py", line 783, in invoke File "icloudpd\base.py", line 745, in main File "icloudpd\base.py", line 1183, in core File "icloudpd\authentication.py", line 53, in authenticate_ File "pyicloud_ipd\base.py", line 160, in init File "pyicloud_ipd\base.py", line 273, in authenticate pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n "serviceErrors" : [ {\n "code" : "-20101",\n "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n "suppressDismissal" : false\n } ]\n} (401)')) [16804] Failed to execute script 'icloudpd' due to unhandled exception!

An update - had the user update their password on iCloud and tried again with the new credentials. Same problem. Here is the output:

Traceback (most recent call last): File "pyicloud_ipd\base.py", line 270, in authenticate pyicloud_ipd.exceptions.PyiCloudAPIResponseException: { "serviceErrors" : [ { "code" : "-20101", "message" : "Enter the email or phone number and password for your Apple Account.", "suppressDismissal" : false } ] } (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last): File "starters\icloudpd.py", line 6, in File "click\core.py", line 1157, in call File "click\core.py", line 1078, in main File "click\core.py", line 1434, in invoke File "click\core.py", line 783, in invoke File "icloudpd\base.py", line 745, in main File "icloudpd\base.py", line 1183, in core File "icloudpd\authentication.py", line 53, in authenticate_ File "pyicloud_ipd\base.py", line 160, in init File "pyicloud_ipd\base.py", line 273, in authenticate pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n "serviceErrors" : [ {\n "code" : "-20101",\n "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n "suppressDismissal" : false\n } ]\n} (401)')) [8548] Failed to execute script 'icloudpd' due to unhandled exception!

Henning256 commented 3 weeks ago

I had the same problem even after I changed my password. The solution was to us the --username and --password parameters. It didn't work when us entered my username in the dialog!

CreativePR commented 3 weeks ago

With this one particular user we are using --username --password and --auth-only but each time we receive the error/output that I posted above. We had a few other users that needed to reauthenticate and they worked with no issue. It (so far) is only with this one user. Again, had this user change their password at iCloud.Com and it was checked and verifed but when using iCloudPD still this error.

Sonnenfleck commented 3 weeks ago

I had the same problem even after I changed my password. The solution was to us the --username and --password parameters. It didn't work when us entered my username in the dialog!

Wasn't enough for me. What helped was this:

icloudpd --username xyz@icloud.com --password xyz --auth-only --password-provider console --mfa-provider console

(I removed the cookies first: rm -r ~/.pyicloudpd - that alone didn't help, but I don't know if it was necessary.)

scttnlsn commented 3 weeks ago

Thanks @Sonnenfleck. That also worked for me.

CreativePR commented 3 weeks ago

We tried the suggestion above using the additional items and on this one account (verified to work on iCloud.Com) still receiving an error:

Output here: File "pyicloud_ipd\base.py", line 270, in authenticate pyicloud_ipd.exceptions.PyiCloudAPIResponseException: { "serviceErrors" : [ { "code" : "-20101", "message" : "Enter the email or phone number and password for your Apple Account.", "suppressDismissal" : false } ] } (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last): File "starters\icloudpd.py", line 6, in File "click\core.py", line 1157, in call File "click\core.py", line 1078, in main File "click\core.py", line 1434, in invoke File "click\core.py", line 783, in invoke File "icloudpd\base.py", line 745, in main File "icloudpd\base.py", line 1183, in core File "icloudpd\authentication.py", line 53, in authenticate_ File "pyicloud_ipd\base.py", line 160, in init File "pyicloud_ipd\base.py", line 273, in authenticate pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n "serviceErrors" : [ {\n "code" : "-20101",\n "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n "suppressDismissal" : false\n } ]\n} (401)')) [26272] Failed to execute script 'icloudpd' due to unhandled exception!

petebocken commented 3 weeks ago

I tried deleting cookies as well, nothing works.

Traceback (most recent call last):
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/pyicloud_ipd/base.py", line 270, in authenticate
    raise PyiCloudAPIResponseException(response.text, str(response.status_code))
pyicloud_ipd.exceptions.PyiCloudAPIResponseException: {
  "serviceErrors" : [ {
    "code" : "-20101",
    "message" : "Enter the email or phone number and password for your Apple Account.",
    "suppressDismissal" : false
  } ]
} (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/homebrew/bin/icloudpd", line 8, in <module>
    sys.exit(main())
             ~~~~^^
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/click/core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/click/core.py", line 1078, in main
    rv = self.invoke(ctx)
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/icloudpd/base.py", line 745, in main
    result = core(
        download_builder(
    ...<50 lines>...
        status_exchange,
    )
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/icloudpd/base.py", line 1183, in core
    icloud = authenticator(
    ...<8 lines>...
        status_exchange,
    )(
        username,
    ...<2 lines>...
        os.environ.get("CLIENT_ID"),
    )
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/icloudpd/authentication.py", line 53, in authenticate_
    icloud = PyiCloudService(
        filename_cleaner,
    ...<7 lines>...
        client_id=client_id,
    )
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/pyicloud_ipd/base.py", line 160, in __init__
    self.authenticate()
    ~~~~~~~~~~~~~~~~~^^
  File "/opt/homebrew/Cellar/icloudpd/1.24.1/libexec/lib/python3.13/site-packages/pyicloud_ipd/base.py", line 280, in authenticate
    raise PyiCloudFailedLoginException(msg, error) from error
pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n  "serviceErrors" : [ {\n    "code" : "-20101",\n    "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n    "suppressDismissal" : false\n  } ]\n} (401)'))

AndreyNikiforov commented 3 weeks ago

another project hints there is a bug in upstream SRP implementation in handling salts that started with zeros. That explains why errors appear for certain account only (salt is persisted per account) and why changing password fixes the issue (presumably salt is re-generated).

There is no explicit confirmation that bug fix worked (e.g. account with error would start working without password reset) though.

AndreyNikiforov commented 2 weeks ago

1.24.2 has the fix.

petebocken commented 2 weeks ago

1.24.2 has the fix.

Still not able to get it to work. Tried deleting cookies and recreating. Tried 3 different Apple accounts.

Traceback (most recent call last):
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/pyicloud_ipd/base.py", line 270, in authenticate
    raise PyiCloudAPIResponseException(response.text, str(response.status_code))
pyicloud_ipd.exceptions.PyiCloudAPIResponseException: {
  "serviceErrors" : [ {
    "code" : "-20101",
    "message" : "Enter the email or phone number and password for your Apple Account.",
    "suppressDismissal" : false
  } ]
} (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/opt/homebrew/bin/icloudpd", line 8, in <module>
    sys.exit(main())
             ~~~~^^
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/click/core.py", line 1157, in __call__
    return self.main(*args, **kwargs)
           ~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/click/core.py", line 1078, in main
    rv = self.invoke(ctx)
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/click/core.py", line 1434, in invoke
    return ctx.invoke(self.callback, **ctx.params)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/click/core.py", line 783, in invoke
    return __callback(*args, **kwargs)
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/icloudpd/base.py", line 745, in main
    result = core(
        download_builder(
    ...<50 lines>...
        status_exchange,
    )
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/icloudpd/base.py", line 1183, in core
    icloud = authenticator(
    ...<8 lines>...
        status_exchange,
    )(
        username,
    ...<2 lines>...
        os.environ.get("CLIENT_ID"),
    )
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/icloudpd/authentication.py", line 53, in authenticate_
    icloud = PyiCloudService(
        filename_cleaner,
    ...<7 lines>...
        client_id=client_id,
    )
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/pyicloud_ipd/base.py", line 160, in __init__
    self.authenticate()
    ~~~~~~~~~~~~~~~~~^^
  File "/opt/homebrew/Cellar/icloudpd/1.24.2/libexec/lib/python3.13/site-packages/pyicloud_ipd/base.py", line 280, in authenticate
    raise PyiCloudFailedLoginException(msg, error) from error
pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n  "serviceErrors" : [ {\n    "code" : "-20101",\n    "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n    "suppressDismissal" : false\n  } ]\n} (401)'))

AndreyNikiforov commented 2 weeks ago

I tried deleting cookies as well, nothing works.

A number of thoughts on the subject:

besides cookies, ppl are clearing keyring passwords as well; I think alternatively you can specify --password-provider console --mfa-provider console to exclude keyring checks; I do not understand how keyring may be related, but worth trying
it may be more accurate to troubleshoot using icloudpd binary instead of homebrew install
if you proceed with homebrew version, check srp version used
error that you see may be not related to the salt issue at all, then no path forward I can think of
last option is to change icloud password - ppl reported that it helped

petebocken commented 2 weeks ago

* last option is to change icloud password - ppl reported that it helped

This worked! Thanks.

Also, for whatever reason I'm again able to remove the --password from my script and rely completely on the saved keyring.

AndreyNikiforov commented 2 weeks ago

We tried the suggestion above using the additional items and on this one account (verified to work on iCloud.Com) still receiving an error:

Output here: File "pyicloud_ipd\base.py", line 270, in authenticate pyicloud_ipd.exceptions.PyiCloudAPIResponseException: { "serviceErrors" : [ { "code" : "-20101", "message" : "Enter the email or phone number and password for your Apple Account.", "suppressDismissal" : false } ] } (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last): File "starters\icloudpd.py", line 6, in File "click\core.py", line 1157, in call File "click\core.py", line 1078, in main File "click\core.py", line 1434, in invoke File "click\core.py", line 783, in invoke File "icloudpd\base.py", line 745, in main File "icloudpd\base.py", line 1183, in core File "icloudpd\authentication.py", line 53, in authenticate_ File "pyicloud_ipd\base.py", line 160, in init File "pyicloud_ipd\base.py", line 273, in authenticate pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n "serviceErrors" : [ {\n "code" : "-20101",\n "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n "suppressDismissal" : false\n } ]\n} (401)')) [26272] Failed to execute script 'icloudpd' due to unhandled exception!

@CreativePR try latest (1.24.3 as of writing), clearing cookies. If still see the same error, post: a) cmd line using downloaded binary b) output (as you were doing before)

CreativePR commented 2 weeks ago

We tried the suggestion above using the additional items and on this one account (verified to work on iCloud.Com) still receiving an error: Output here: File "pyicloud_ipd\base.py", line 270, in authenticate pyicloudipd.exceptions.PyiCloudAPIResponseException: { "serviceErrors" : [ { "code" : "-20101", "message" : "Enter the email or phone number and password for your Apple Account.", "suppressDismissal" : false } ] } (401) The above exception was the direct cause of the following exception: Traceback (most recent call last): File "starters\icloudpd.py", line 6, in File "click\core.py", line 1157, in call File "click\core.py", line 1078, in main File "click\core.py", line 1434, in invoke File "click\core.py", line 783, in invoke File "icloudpd\base.py", line 745, in main File "icloudpd\base.py", line 1183, in core File "icloudpd\authentication.py", line 53, in authenticate File "pyicloud_ipd\base.py", line 160, in init File "pyicloud_ipd\base.py", line 273, in authenticate pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n "serviceErrors" : [ {\n "code" : "-20101",\n "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n "suppressDismissal" : false\n } ]\n} (401)')) [26272] Failed to execute script 'icloudpd' due to unhandled exception!

@CreativePR try latest (1.24.3 as of writing), clearing cookies. If still see the same error, post: a) cmd line using downloaded binary b) output (as you were doing before)

Downloaded the 1.24.3 release for Windows and this was the error output on that same account:

2024-11-03 21:20:04 DEBUG Authenticating... Traceback (most recent call last): File "pyicloud_ipd\base.py", line 270, in authenticate pyicloud_ipd.exceptions.PyiCloudAPIResponseException: { "serviceErrors" : [ { "code" : "-20101", "message" : "Enter the email or phone number and password for your Apple Account.", "suppressDismissal" : false } ] } (401)

The above exception was the direct cause of the following exception:

Traceback (most recent call last): File "starters\icloudpd.py", line 6, in File "click\core.py", line 1157, in call File "click\core.py", line 1078, in main File "click\core.py", line 1434, in invoke File "click\core.py", line 783, in invoke File "icloudpd\base.py", line 745, in main File "icloudpd\base.py", line 1183, in core File "icloudpd\authentication.py", line 53, in authenticate_ File "pyicloud_ipd\base.py", line 160, in init File "pyicloud_ipd\base.py", line 280, in authenticate pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseException('{\n "serviceErrors" : [ {\n "code" : "-20101",\n "message" : "Enter the email or phone number and password for your Apple\xa0Account.",\n "suppressDismissal" : false\n } ]\n} (401)')) [4292] Failed to execute script 'icloudpd' due to unhandled exception!

Other accounts are not having a problem reauthenticating (as before) - it is only this one account. Verified that the account can be logged in with the same exact credentials on icloud.com

AlexSmirnov9107 commented 2 weeks ago

same here

iowk commented 2 weeks ago

Starting from an hour ago, requests to signin/init are giving 503 responses.

Is anyone facing similar issue?

Update: It's working again now. It was failing on multiple accounts that worked before even with different PCs. Weird.

icloud-photos-downloader / icloud_photos_downloader