Firmware 8.1 /auth/request not working anymore

[walterww 2]

Hello there,

 

we're controlling a few Ultimakers through the local API and depend heavily on this feature. It seems the new version 8.1 doesn't show the authentication method described in the API documentation does not work anymore: 

 

[qutote]To get a valid username/password combination, the following process can/should be followed.

1) POST /auth/request with 'application' and 'user' as parameters. The application name and user name will be shown to the user on the printer. The reply body will contain a json reply with an 'id' and 'key' part.[/quote]

The request is not shown on the printer's display anymore (and the id/key pair can therefore not be allowed). Without this some API calls don't work.

[tomnagel 126]

Hi Walter,

We're looking into this, this was unintentional. I am very sorry to hear that this breaks your workflow.

In the meantime you may want to downgrade back to 7.1.3. Please note that this can only be done via the recovery procedure with an SD card, not via the UI panel on the printer.

 

See this post  for a link to the instructions.

 

Can't promise anything now, but we intend to fix this with a patch release.

 

Edited February 23, 2023 by tomnagel

[walterww 2]

Hi Tom, thank you for your help!

 

We will probably downgrade to 7.1.3 and skip firmware 8.1.

 

Unless. is there perhaps another workaround?

Is there a config file or something similar I could modify in DEV mode/SSH console in order to enable an id/key pair?

[Josnoww 15]

Hi @walterww,

 

I am sorry to hear you are having trouble with the API. We are currently on a working fix, that will likely be included in the next firmware release.

In the mean time it is possible to work around the issue (on 8.1.0), however this does require you to be in developer mode, and SSH into the printer. If do not feel comfortable doing this I would recommend downgrading and waiting for the next firmware release. Otherwise here are the steps to work around the issue:

1. Enable developer mode on the printer.  (Be aware that this does mean everyone on your network can access the printer, and thus all the files and keys on it!)
2. SSH into the printer as root user (ssh root@<your_printer_ip>). The password is 'ultimaker'
3. Execute 

   cat /var/lib/griffin/http_api_users.json

    

4. You will get an output similar to this:
   

5. The selected parts show the ID and password you can use for the API (they will be different for each printer). The top one is the ID, and the bottom one the password.

6. You should now be able to use the API like normal.

 

I hope this helps, please let me know if this works for you. 

 

Jos

 

 

Edited February 23, 2023 by Josnoww

[tomnagel 126]

By the way, we were wondering why your existing IS and keys stopped working. The file Jos is referring to is not touched during a normal firmware upgrade. Can you maybe explain that?

[walterww 2]

@Josnoww Wow, this is really helpful! Thank you. I'm not afraid of a little SSH.

 

@tomnagel Yes I can explain that. Short version: I didn't know that and generate new API keys after every upgrade.

 

Yes that sounds stupid, but here's the long version: 

We are a Maker Space where people are allowed to use our machines on their own. So in order to keep track of who does what, and also to limit the use to active users (i.e. paying customers) who attended the respective safety course, we use a management system (fabman.io) that uses NFC readers to authenticate users and activate machines. Many machines are simply switched on and off using a relay, but for the UltimakerS I was able to code a python script that runs ON THE PRINTER, watches printer status and checks if anyone has been authenticated when a job starts. If not, the job is paused. And it also logs how much material was used by whom, which saves us a lot of trouble. I love you for this! 😄 

 

This script is purged from the printer's filesystem every time a new firmware version is installed; but that's OK for me, I wrote an installation script that copies the script to the printers and configures them to start it automatically as well.

 

I was not aware that the API keys are retained during a normal firmware upgrade, as my keys never leave the printers... my installation script creates a new key after every reinstall. I think @Josnoww just helped me getting rid of having to do that.

 

(I could run the script on a server in our network instead of on the printers, but a creative user could simply turn off a printer's WiFi or network and print for free. I'm quite sure we'd figure out who it was, but that costs time and none the less we try to make our authentication system as secure as possible.)

Edited February 23, 2023 by walterww