SynologyDSM doesn't handle 2-step authentication

[chemelli74]

Hi,

just found that is this library to handle the communication;
Please check home-assistant/core#31477

At the end of the thread there is the official API calls.

Thank you,

Simone

[chemelli74]

@Quentame, do you think that after your improvements and rework in 0.5.0 you can implement also this ? ;-)

Simone

[Quentame]

Hi @chemelli74 !

Hope you are doing fine, it's crazy out there (I'm on the other side of the Alps).

Will think about it 😉 , just add it to the 0.6.0 release !

As I have to lot of work at the moment, I'll apreciate any first draft on this feature, PR are welcomed !

Thank you.

[Quentame]

Copy from home-assistant/core#31477 (comment) :

From Synology support:

Step 1. Login with OTP and enable device token

query:

GET / HTTP/1.1
  webapi/auth.cgi
  ?api=SYNO.API.Auth&version=6&method=login&enable_device_token=yes&otp_code={otp_code}&account={account}&passwd={passwd}&device_name={device_name}

answer:

HTTP/1.1 200 OK
Content-type: text/plain;

{
   "data": {
       "did": "F0frflccRq3St5DERrmItae7C9HS5r6kR8VjfsqQWJv2bC3vCoYADD4q4OTzsvpOUahjZlIT46684G36ElKEYW12dApreP5lYyjaHSF8pH54SQnWIZZVaOrkSNtKNVT",
       "is_portal_port": false,
       "sid": "tMHwU7PPVGDAU1530LSN299702"
   },
   "success": true
}

Step 2. Login with device name and without OTP

query:

GET / HTTP/1.1
  webapi/auth.cgi GET HTTP/1.1
  ?api=SYNO.API.Auth&version=6&method=login&account=XXX&passwd=YYY&device_name=ZZZ&device_id=F0frflccRq3St5DERrmItae7C9HS5r6kR8VjfsqQWJv2bC3vCoYADD4q4OTzsvpOUahjZlIT46684G36ElKEYW12dApreP5lYyjaHSF8pH54SQnWIZZVaOrkSNtKNVT

answer:

HTTP/1.1 200 OK
Content-type: text/plain;
 
{
   "data": {
       "is_portal_port": false,
       "sid": "CujcTs2Wu7z3w1530LSN299702"
   },
   "success": true
}

[Quentame]

Seems not too complicated.

That's odd that we should send account + password on step 2, same for password in step 1.

Should the user know if the account is 2-SA or the library can know it with a request ?

[chemelli74]

Seems not too complicated.

:-)

That's odd that we should send account + password on step 2, same for password in step 1.

As I read the suggestion step 1 is the first time ever you login. Step 2 is for all subsequent login.
So the call in step 1 is needed only during configuration flow, you then store the device_name with device_id.
After that you will be able to authenticate using the call from step 2 for all queries.

Should the user know if the account is 2-SA or the library can know it with a request ?

Nope, no way to get it programmatically.
I would suggest something like: if login/password fail show a message to the user about wrong username/password or missing OTP code.

Simone

[chemelli74]

Seems we can get some insights with returned error codes.
All tests performed with admin account and 2-step auth enabled:

- old API call, no OTP specified :	error 403
- wrong OTP: 			        error 404
- wrong pwd: 			        error 400

Simone

[chemelli74]

Offical info on error codes from Syno API guide, pag. 16:

Simone

[Quentame]

Very nice @chemelli74, thanks for this API guide ! 🎉

So we can programatically with HTTP codes, even more easier 💃

Don't hesitate to add API documentations/guides to the README with a PR 😉
That will be very usefull 👍

[chemelli74]

As I know nothing about python, I wrote a bash script to see if everything works as it should.
If you are interested, check it out @ pastebin

Simone

[Quentame]

While testing your file I have : zsh: ./synology_api_auth_test.sh: bad interpreter: /bin/bash^M: no such file or directory

And testing with a 2SA account I got {"error":{"code":400},"success":false} and I should got 403 ...

[chemelli74]

While testing your file I have : zsh: ./synology_api_auth_test.sh: bad interpreter: /bin/bash^M: no such file or directory

First line should be " #!/bin/bash", seems there is a extra CR on the end somehow.

And testing with a 2SA account I got {"error":{"code":400},"success":false} and I should got 403 ...

400 is login error; can you please double check username & pwd ? Maybe special characters in pwd are not handled correctly by my draft code.

Simone

[chemelli74]

Try downloading script using " wget https://pastebin.com/raw/SJc7pbv0" (raw file).
Should fix the extra ^M you see.

Simone

[Quentame]

Thanks I forgot to tell that I'm on a UNIX based system, but you get it.
I looked stuffs about this but did'nt find real solution.

Fot the 400, I put the link directly on my browser address bar, and I double checked my credentials, after some tries, I went to DSM, connect, enter the 2SA code and that worked.
Will try more tonight/this week-end.

[Quentame]

Can you register there #26 ?

[Quentame]

By entering "https://$host:$port/webapi/auth.cgi?api=SYNO.API.Auth&version=$apiver&method=login&enable_device_token=yes&account=$usr&passwd=$pwd&device_name=$device_name" with right values on your web browser, what answer are you getting ?

I'm on DSM 6

[Quentame]

I'm seeing a "SYNO.API.OTP" api on DSM 6 : https://github.com/kwent/syno/blob/master/definitions/DSM/6.2.2/24922/query.api

[Quentame]

Have you tested your script ?
If yes, is it working ?

On which DSM version ?

May you provide requests (anonymize, host + credentials) ?

[chemelli74]

Can you register there #26 ?

Done

[chemelli74]

Have you tested your script ?

Yes

If yes, is it working ?

:-) of course

On which DSM version ?

6.2.2

May you provide requests (anonymize, host + credentials) ?

Will do tomorrow, no access to NAS right now

P.S. Try also from localhost

[Quentame]

Sorry but can’t test on local network, I’m in self quarantine at parent’s house.

[chemelli74]

Sorry but can’t test on local network, I’m in self quarantine at parent’s house.

So you are testing trough internet ? Your NAS is published by a firewall nat rule ?

If so I can test this config as well.

Simone

[Quentame]

Yes, from this address : https://nas.my_website.com:443/
So it uses reverse proxy.

The NAS has basic firewall set.

Connecting throw the DSM UI is working and asking 2SA code from Google Authenticator.

[Quentame]

Find the solution !

My user was from the "users" group only, adding "administrators" solves, I got the 403 🎉

[Quentame]

Successfully getting the device ID!

Coding in progress 🔄

[Quentame]

So actually, this is a bug on the Synology API side: the password is correct so it should not send me a 400 code, but a 402 "Permission denied" ...

First draft here #29

Will try later this week-end with an HA implementation 😉