OpenRemote does not authenticate with ZWay

[pz1]

I could repeat your experiment on my RPi, and even from the other RPi with

Code: Select all

 curl -v -u admin:admin http://raspberrypi:8083/OpenRemote/SwitchBinaryStatus/9/0

So that seems to work OK. I'll have a closer look at the OR side.

[pofs]

I'd try to run a sniffer like Wireshark and see what is really sent over the network. Maybe they're using http://user:passwd@host scheme which is not supported by z-way.

We're probably not going to bother implementing user and password in url scheme, which is not supported anymore even by MS IE after version 6 And it has nothing to do with basic authentication, it is just a format of url. The client software (browser) is responsible for translating login and password url part into correct Authorization header.

[pz1]

Maybe they're using http://user:passwd@host scheme which is not supported by z-way.

Marcus, one of their developers told they are not. They seem to do it properly with the http-headers.

I did some further testing with ZWaveAPI

Code: Select all

curl -g -v -u JohnDoe:SeCret http://raspberrypi:8083/ZWaveAPI/Run/devices[9].instances[0].SwitchBinary.data.level.value

does return true and false.
And similarly if I do place that url in the OpenRemote configuration I do get false and true returned to OpenRemote.

update 20150917: It appears that ZwaveAPI is not blocked if authentication is enabled in the HA UI.

[pz1]

Maybe they're using http://user:passwd@host scheme which is not supported by z-way.

Marcus, one of their developers told they are not. They seem to do it properly with the http-headers.

If I use ZAutomation

Code: Select all

http://raspberrypi:8083/ZAutomation/api/v1/devices/ZWayVDev_zway_9-0-37

I do get error Unauthorized

Code: Select all

2015-09-17 10:24:53,332 ERROR [Polling Sensor Thread ID = 248217, Name ='Duwi']: ClientProtocolException when executing HTTP method
org.apache.http.client.HttpResponseException: Unauthorized

If I use OpenRemote

Code: Select all

http://raspberrypi:8083/OpenRemote/SwitchBinaryStatus/9/0

I do get error Forbidden

Code: Select all

2015-09-17 10:41:43,511 ERROR [Polling Sensor Thread ID = 248217, Name ='Duwi']: ClientProtocolException when executing HTTP method
org.apache.http.client.HttpResponseException: Forbidden

Why these different responses?

(Haven't started with Wireshark yet, its complicated and seems rather unsafe to install. Isn't there a simpler method to capture the http-message sent by OpenRemote?)
update 20150917-19:37 After some experiments with TCPDUMP I have posted some questions to OpenRemote

[pofs]

Yup, there's a little inconsistency in HTTP statuses between /ZAutomation route and everything else, because /ZAutomation manages per-user access to devices and stuff and enforces its own logic (next in chain after webserver's handler). But it really doesn't affect the outcome, as your client doesn't send Authorization header at all

[pz1]

I did get this answer from Marcus on the OpenRemote forum:

I did some investigation and the situation is as follows:

1) If the username is not given then no authentication will be performed at all (empty username is not supported)

2) Our library first tries the connection without basic authentication. If that fails (HTTP 401 given by server) then the authentication header is added and the request is performed a second time. I confirmed this with tcpdump.

It looks like razberry is not following the HTTP specs. They send a "403 forbidden" even if no authentication information is provided.
They first need to send a "401 unauthorized" and only if the wrong user is given they are allowed to send "403 forbidden".

[Maverick75]

I think i have exactly this problem and it is driving me mad !

If i execute the Razbian Openremote helper directly from a URL it works fine.
But if i use the remote app i get :-

ERROR [HTTP-Thread-5]: ClientProtocolException when executing HTTP method
org.apache.http.client.HttpResponseException: Forbidden

This was working up until I did an update on Sunday 4th Oct Afternoon (just after designer went off line for an update) << I don't know if this is related !
Any idea how i get around the Forbidden error ?

Everything (software) is up to date !

[pz1]

http://www.openremote.org/display/docs/ ... h+Razberry

Second note from the top

[Maverick75]

It now works 100%!
The frustrating thing is I already followed the instructions and built the anonymous user but for some odd reason it was set to an admin role i don't know why!

But thanks for the advice

[pz1]

Be aware that you do not have proper protection now