Failed to retrieve Access Token - Connection refused

[tetele]

I've been using the integration for a few weeks without any issue. All of a sudden, since yesterday, it started complaining about not being able to refresh tokens due to "Connection refused" errors when exchanging OAuth refresh tokens for access tokens. My first thought was that it was a temporary server issue, so no problem with the integration itself.

After several core restarts and integration reload attempts, I've removed the integration and tried to re-add it, but it fails with this message:

Failed to retrieve Access Token: ('Error trying to follow redirect: %s', ConnectionError(MaxRetryError("HTTPSConnectionPool(host='fidm.eu1.gigya.com', port=443): Max retries exceeded with url: /saml/v2.0/xxxxxxxxxxxxxx/idp/sso?SAMLRequest=xxxxxxxxxxxxxxxxxxxx (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7ff7d261b550>: Failed to establish a new connection: [Errno 111] Connection refused'))")))

[rospogrigio]

Some users had this problems sometimes, and it looked like there was a problem with the system time. I suggest you check it is correct, and to try to reboot your server. There may also be some problems server-side, though so you might need to retry later. Good luck

[tetele]

Same issue after reboot. I'll wait for a while longer to see if it's a server problem.

[davidepanato]

I'm also having same problem, in the logs I can see:

Error setting up entry Daikin for daikin_residential 13:27:50 – (ERRORE) Daikin Residential Controller (integrazione personalizzata) CANNOT REFRESH TOKENSET (400): will login again and retrieve a new tokenSet. 13:27:48 – (AVVISO) Daikin Residential Controller (integrazione personalizzata)

[Rajackar]

Installed this today and also getting this error:

2022-09-27 15:00:10.723 ERROR (MainThread) [custom_components.daikin_residential.config_flow] Failed to retrieve Access Token: ('Error trying to extract API version: %s', ConnectionError(MaxRetryError("HTTPSConnectionPool(host='cdns.gigya.com', port=443): Max retries exceeded with ur l: /js/gigya.js?apiKey=3_xRB3jaQ62bVjqXU1omaEsPDVYC0Twi1zfq1zHPu_5HFT0zWkDvZJS97Yw1loJnTm (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f52c5d1e7a0>: Failed to establish a new connection: [Errno 111] Connection refused'))")))

[rospogrigio]

Damn, I'm having the same problem too now. Let's hope it's just a downtime of the API server, because they might have changed something in the authentication and that would hurt. Let's wait some time and see if it will start working again... please let me know if you succeed later.

[davidepanato]

Still not working at the moment

[Rajackar]

Tried today and still getting this error.

[rospogrigio]

OK something is working strangely... can you try the script tokensaver.py you find in the tools folder and see if it works? Usage is ./tokensaver.py <login> <password> It is working on my setup. Let me know...

[Rajackar]

Ran it from my docker container running HA. This is the output. Hope it helps:

bash-5.1# python3 tokensaver.py xxxx xxxx PARAMS: xxxx xxxx STATE: IMU4j10rxDC7vVvRVCp8z-IGTp1hDSjyltSrZ9ubxSw Traceback (most recent call last): File "/usr/local/lib/python3.10/site-packages/urllib3/connection.py", line 174, in _new_conn conn = connection.create_connection( File "/usr/local/lib/python3.10/site-packages/urllib3/util/connection.py", line 95, in create_connection raise err File "/usr/local/lib/python3.10/site-packages/urllib3/util/connection.py", line 85, in create_connection sock.connect(sa) ConnectionRefusedError: [Errno 111] Connection refused

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 703, in urlopen httplib_response = self._make_request( File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 386, in _make_request self._validate_conn(conn) File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 1042, in _validate_conn conn.connect() File "/usr/local/lib/python3.10/site-packages/urllib3/connection.py", line 358, in connect self.sock = conn = self._new_conn() File "/usr/local/lib/python3.10/site-packages/urllib3/connection.py", line 186, in _new_conn raise NewConnectionError( urllib3.exceptions.NewConnectionError: <urllib3.connection.HTTPSConnection object at 0x7f46b1ca55a0>: Failed to establish a new connection: [Errno 111] Connection refused

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/local/lib/python3.10/site-packages/requests/adapters.py", line 489, in send resp = conn.urlopen( File "/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py", line 787, in urlopen retries = retries.increment( File "/usr/local/lib/python3.10/site-packages/urllib3/util/retry.py", line 592, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause)) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='cdns.gigya.com', port=443): Max retries exceeded with url: /js/gigya.js?apiKey=3_xRB3jaQ62bVjqXU1omaEsPDVYC0Twi1zfq1zHPu_5HFT0zWkDvZJS97Yw1loJnTm (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f46b1ca55a0>: Failed to establish a new connection: [Errno 111] Connection refused'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/config/custom_components/daikin_residential/tokensaver.py", line 245, in retrieveAccessToken body = requests.get('https://cdns.gigya.com/js/gigya.js', { File "/usr/local/lib/python3.10/site-packages/requests/api.py", line 73, in get return request("get", url, params=params, kwargs) File "/usr/local/lib/python3.10/site-packages/requests/api.py", line 59, in request return session.request(method=method, url=url, kwargs) File "/usr/local/lib/python3.10/site-packages/requests/sessions.py", line 587, in request resp = self.send(prep, send_kwargs) File "/usr/local/lib/python3.10/site-packages/requests/sessions.py", line 701, in send r = adapter.send(request, kwargs) File "/usr/local/lib/python3.10/site-packages/requests/adapters.py", line 565, in send raise ConnectionError(e, request=request) requests.exceptions.ConnectionError: HTTPSConnectionPool(host='cdns.gigya.com', port=443): Max retries exceeded with url: /js/gigya.js?apiKey=3_xRB3jaQ62bVjqXU1omaEsPDVYC0Twi1zfq1zHPu_5HFT0zWkDvZJS97Yw1loJnTm (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f46b1ca55a0>: Failed to establish a new connection: [Errno 111] Connection refused'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/config/custom_components/daikin_residential/tokensaver.py", line 479, in asyncio.run(main()) File "/usr/local/lib/python3.10/asyncio/runners.py", line 44, in run return loop.run_until_complete(main) File "/usr/local/lib/python3.10/asyncio/base_events.py", line 646, in run_until_complete return future.result() File "/config/custom_components/daikin_residential/tokensaver.py", line 467, in main tokenSet = await controller.retrieveAccessToken(user, pwd) File "/config/custom_components/daikin_residential/tokensaver.py", line 254, in retrieveAccessToken raise Exception('Error trying to extract API version') Exception: Error trying to extract API version

[rospogrigio]

It is failling to launch the HTTP commands, can you launch it from outside docker?

[Rajackar]

Just ran the script and I saw a number of certificate errors. Turns out PiHole was killing the connection to the servers. Looking at the log I whitelisted these two: cdns.gigya.com fidm.eu1.gigya.com

It's still not working but the error in the log has now changed to this:

022-09-29 11:51:11.507 ERROR (MainThread) [custom_components.daikin_residential.config_flow] Failed to retrieve Access Token: ('Failed to retrieve access token: %s', IATError('Issued in the future'))

[rospogrigio]

Now I think you have a system time issue. Try to check it or reboot the device

[Rajackar]

Checked it and Timezone and time is set correctly. I did run the tokensaver again and output looks like this (changed some data to xxxx for security):

PARAMS: userxxx passxxx STATE: rC-nAjz16ju892XFTxFCy9qUgH-xxxxxxxxxxxxxx VERSION: 13406-3-27740700 LOGIN REPLY: {'callId': 'fc216b1043b84cc8af630ab9a90be6d6', 'errorCode': 0, 'apiVersion': 2, 'statusCode': 200, 'statusReason': 'OK', 'time': '2022-09-29T09:48:10.942Z', 'registeredTimestamp': 1664280529, 'UID': 'xxxxx', 'UIDSignature': 'xxxx=', 'signatureTimestamp': '1664444890', 'created': '2022-09-27T12:08:34.034Z', 'createdTimestamp': 1664280514, 'isActive': True, 'isRegistered': True, 'isVerified': True, 'lastLogin': '2022-09-29T09:48:10.904Z', 'lastLoginTimestamp': 1664444890, 'lastUpdated': '2022-09-27T12:09:03.211Z', 'lastUpdatedTimestamp': 1664280543211, 'loginProvider': 'site', 'oldestDataUpdated': '2022-09-27T12:08:34.034Z', 'oldestDataUpdatedTimestamp': 1664280514034, 'profile': {'firstName': 'xxx', 'lastName': 'xxxx', 'country': 'NL', 'email': 'oxxxxx@xxxxxx.com'}, 'registered': '2022-09-27T12:08:49.946Z', 'socialProviders': 'site', 'verified': '2022-09-27T12:09:03.211Z', 'verifiedTimestamp': 1664280543211, 'newUser': False, 'sessionInfo': {'login_token': 'xxxxxxxxx.sc3', 'expires_in': '31536000'}} VERIFIER: xxxxxxxxxxxxxxxxxx Traceback (most recent call last): File "./tokensaver.py", line 479, in asyncio.run(main()) File "/usr/lib/python3.8/asyncio/runners.py", line 44, in run return loop.run_until_complete(main) File "/usr/lib/python3.8/asyncio/base_events.py", line 616, in run_until_complete return future.result() File "./tokensaver.py", line 467, in main tokenSet = await controller.retrieveAccessToken(user, pwd) File "./tokensaver.py", line 376, in retrieveAccessToken self.tokenSet = await self._doAccessTokenRequest(daikinunified_url) File "./tokensaver.py", line 195, in _doAccessTokenRequest rtk_resp = self.openIdClient.do_access_token_request(request_args=args, extra_args=callbackParams, state=state, authn_method=None) File "/var/services/homes/rajackar/.local/lib/python3.8/site-packages/oic/oic/init.py", line 703, in do_access_token_request atr = super().do_access_token_request( File "/var/services/homes/rajackar/.local/lib/python3.8/site-packages/oic/oauth2/init.py", line 922, in do_access_token_request return self.request_and_return( File "/var/services/homes/rajackar/.local/lib/python3.8/site-packages/oic/oauth2/init.py", line 815, in request_and_return return self.parse_request_response(resp, response, body_type, state, kwargs) File "/var/services/homes/rajackar/.local/lib/python3.8/site-packages/oic/oauth2/init.py", line 756, in parse_request_response return self.parse_response( File "/var/services/homes/rajackar/.local/lib/python3.8/site-packages/oic/oauth2/init.py", line 675, in parse_response verf = resp.verify(kwargs) File "/var/services/homes/rajackar/.local/lib/python3.8/site-packages/oic/oic/message.py", line 360, in verify self["id_token"] = verify_id_token(self, kwargs) File "/var/services/homes/rajackar/.local/lib/python3.8/site-packages/oic/oic/message.py", line 311, in verify_id_token if not idt.verify(kwargs): File "/var/services/homes/rajackar/.local/lib/python3.8/site-packages/oic/oic/message.py", line 790, in verify raise IATError("Issued in the future") oic.oic.message.IATError: Issued in the future

[rospogrigio]

Try rebooting the device (some users solved it this way). The other suggestion would be to change the password to change the remote timestamps... not sure if it will work though. I don't have other ideas.

[Rajackar]

Wellllll, turns out the NAS running the container was set to sync with google time servers and I noticed a two minute discrepancy with my laptop. Changing to ntp.org actually fixed this and now it's working perfectly. So it turns out I had two issues. First PiHole was blocking the URL's and google was providing me with the wrong time. This might be of interest to other people running into the same issue. Thanks for helping me investigate and fix this. Much appreciated.

[rospogrigio]

Are you saying that now the Integration is working fine? Thank you for your feedback!

[tetele]

Same thing here: PiHole was blocking the domains, but I haven't had the time synchronization issues.

Thanks @Rajackar for the hint!

[Rajackar]

Are you saying that now the Integration is working fine? Thank you for your feedback!

Yes. I was just able to add my devices to HA. My guess is that somehow the API URLs got added to some blacklist. Thanks for creating this!

[Xander-V]

Wellllll, turns out the NAS running the container was set to sync with google time servers and I noticed a two minute discrepancy with my laptop. Changing to ntp.org actually fixed this and now it's working perfectly. So it turns out I had two issues. First PiHole was blocking the URL's and google was providing me with the wrong time. This might be of interest to other people running into the same issue. Thanks for helping me investigate and fix this. Much appreciated.

This was exactly my problem indeed, changed time server to NTP.org and everything started working again! Thanks for pointing it out.