Can no longer log in: Bad username or password #729
Comments
|
I'm having the same issue. Hoping it's a temporary problem with iCloud itself. I was able to log in just yesterday with iCloudPD, and my configuration has not changed since then. |
|
Same issue as well, failure to login, even after changing password to something simple. |
|
I can replicate the issue on docker with 1.16.3 without keyring, so it is general issue and most likely related to some changes on Apple side as my 1.16.3 was running for a number of days before the issue started. |
|
Same here |
1 similar comment
|
Same here |
|
also experiencing the same issue with 1.16.2 as well as after upgrading to 1.16.3 |
|
Same here |
|
Same issue - container has stopped downloading today |
|
Same issue here, stopped working yesterday Dec 6 |
|
Same. Following this thread for updates. |
|
Following |
|
Same here, following |
|
Same, following; |
|
I also get the same error on two different iCloud accounts. Suddenly stopped working 2 days ago. Both of my boredazfcuk/docker-icloudpd containers stopped and also manual execution of the script During handling of the above exception, another exception occurred: Traceback (most recent call last): File "starters/icloudpd.py", line 5, in File "click/core.py", line 1157, in call File "click/core.py", line 1078, in main File "click/core.py", line 1434, in invoke File "click/core.py", line 783, in invoke File "icloudpd/base.py", line 317, in main File "icloudpd/base.py", line 744, in core File "icloudpd/authentication.py", line 31, in authenticate_ File "pyicloud_ipd/base.py", line 204, in init File "pyicloud_ipd/base.py", line 228, in authenticate pyicloud_ipd.exceptions.PyiCloudFailedLoginException: ('Invalid email/password combination.', PyiCloudAPIResponseError('Unknown reason')) [1357605] Failed to execute script 'icloudpd' due to unhandled exception!_ Logging in on the icloud.com website works as it should. |
|
Same, following; |
|
just following. |
Then please just please subscribe, nobody wants to get spammed with "just following" updates! |
|
Hi, maybe it will help to solve the problem. I have three icloud Accounts running and the issue is the same in every account. icloudpd --directory /xxx/xxx/xxx/icloudpd_photo_backup --username xxxxxxxxxxxxx@icloud.com --password xxxxxxxx --log-level debug During handling of the above exception, another exception occurred: Traceback (most recent call last): |
|
I'm experiencing this too. Started on the 6th at around 5pm EST. |
|
I see the following paths:
Is anybody interested in 1) and/or 2)? I plan to allocate some time in the next number of days to look into this issue and will invest in 1 & 3. IMO it is okay for multiple ppl to look at the same path as there are always edge cases and different approaches that may give different or complementing outcomes. |
|
@AndreyNikiforov Thanks for the summary / plans of attack. To help guide others that may want to debug, a possible good test case to try is within the The tests will fail, and the VCR recording (aka "cassette") will be updated with the actual response received from icloud. BE SURE TO NOT SHARE YOUR USERNAME/PASSWORD WHICH ARE PRESENT IN THE VCR RECORDING! For instance, after doing the above, this is the diff of the VCR cassette. I can't glean much useful information from the response yet:
"git diff" of the VCR yaml filediff --git a/tests/vcr_cassettes/auth_requires_2sa.yml b/tests/vcr_cassettes/auth_requires_2sa.yml
index d0bbf78..ad75ec9 100644
--- a/tests/vcr_cassettes/auth_requires_2sa.yml
+++ b/tests/vcr_cassettes/auth_requires_2sa.yml
@@ -1,37 +1,59 @@
interactions:
- request:
- body: !!python/unicode '{"apple_id": "jdoe@gmail.com", "password": "password1",
- "extended_login": false}'
+ body: '{"apple_id": "jdoe@gmail.com", "password": "password1", "extended_login":
+ false}'
headers:
- Accept: ['*/*']
- Accept-Encoding: ['gzip, deflate']
- Connection: [keep-alive]
- Content-Length: ['88']
- Origin: ['https://www.icloud.com']
- Referer: ['https://www.icloud.com/']
- User-Agent: [Opera/9.52 (X11; Linux i686; U; en)]
+ Accept:
+ - '*/*'
+ Accept-Encoding:
+ - gzip, deflate
+ Connection:
+ - keep-alive
+ Content-Length:
+ - '90'
+ Origin:
+ - https://www.icloud.com
+ Referer:
+ - https://www.icloud.com/
+ User-Agent:
+ - Opera/9.52 (X11; Linux i686; U; en)
method: POST
- uri: https://setup.icloud.com/setup/ws/1/login?clientBuildNumber=17DHotfix5&clientMasteringNumber=17DHotfix5&clientId=EC5646DE-9423-11E8-BF21-14109FE0B321&ckjsVersion=2.0.5&ckjsBuildVersion=17DProjectDev77
+ uri: https://setup.icloud.com/setup/ws/1/login?clientBuildNumber=17DHotfix5&clientMasteringNumber=17DHotfix5&ckjsBuildVersion=17DProjectDev77&ckjsVersion=2.0.5&clientId=EC5646DE-9423-11E8-BF21-14109FE0B321
response:
- body: {string: !!python/unicode '{"dsInfo":{"lastName":"Doe","iCDPEnabled":false,"dsid":"123456789","hsaEnabled":true,"ironcadeMigrated":true,"locale":"en-us_US","brZoneConsolidated":false,"isManagedAppleID":false,"gilligan-invited":"true","appleIdAliases":["jdoe@icloud.com"],"hsaVersion":2,"isPaidDeveloper":true,"countryCode":"USA","notificationId":"12341234-1234-1234-1234-143241234123","primaryEmailVerified":true,"aDsID":"12341234123412341234","locked":false,"hasICloudQualifyingDevice":true,"primaryEmail":"jdoe@gmail.com","appleIdEntries":[{"isPrimary":true,"type":"EMAIL","value":"jdoe@gmail.com"}],"gilligan-enabled":"true","fullName":"John
- Doe","languageCode":"en-us","appleId":"jdoe@gmail.com","firstName":"John","iCloudAppleIdAlias":"jdoe@icloud.com","notesMigrated":true,"hasPaymentInfo":true,"pcsDeleted":false,"appleIdAlias":"","brMigrated":true,"statusCode":2},"hasMinimumDeviceForPhotosWeb":true,"iCDPEnabled":false,"webservices":{"reminders":{"url":"https://p10-remindersws.icloud.com:443","status":"active"},"notes":{"url":"https://p10-notesws.icloud.com:443","status":"active"},"mail":{"url":"https://p10-mailws.icloud.com:443","status":"active"},"ckdatabasews":{"pcsRequired":true,"url":"https://p10-ckdatabasews.icloud.com:443","status":"active"},"photosupload":{"pcsRequired":true,"url":"https://p10-uploadphotosws.icloud.com:443","status":"active"},"photos":{"pcsRequired":true,"uploadUrl":"https://p10-uploadphotosws.icloud.com:443","url":"https://p10-photosws.icloud.com:443","status":"active"},"drivews":{"pcsRequired":true,"url":"https://p10-drivews.icloud.com:443","status":"active"},"uploadimagews":{"url":"https://p10-uploadimagews.icloud.com:443","status":"active"},"schoolwork":{},"cksharews":{"url":"https://p10-ckshare.icloud.com:443","status":"active"},"findme":{"url":"https://p10-fmipweb.icloud.com:443","status":"active"},"ckdeviceservice":{"url":"https://p10-ckdevice.icloud.com:443"},"iworkthumbnailws":{"url":"https://p10-iworkthumbnailws.icloud.com:443","status":"active"},"calendar":{"url":"https://p10-calendarws.icloud.com:443","status":"active"},"docws":{"pcsRequired":true,"url":"https://p10-docws.icloud.com:443","status":"active"},"settings":{"url":"https://p10-settingsws.icloud.com:443","status":"active"},"ubiquity":{"url":"https://p10-ubiquityws.icloud.com:443","status":"active"},"streams":{"url":"https://p10-streams.icloud.com:443","status":"active"},"keyvalue":{"url":"https://p10-keyvalueservice.icloud.com:443","status":"active"},"archivews":{"url":"https://p10-archivews.icloud.com:443","status":"active"},"push":{"url":"https://p10-pushws.icloud.com:443","status":"active"},"iwmb":{"url":"https://p10-iwmb.icloud.com:443","status":"active"},"iworkexportws":{"url":"https://p10-iworkexportws.icloud.com:443","status":"active"},"geows":{"url":"https://p10-geows.icloud.com:443","status":"active"},"account":{"iCloudEnv":{"shortId":"p","vipSuffix":"p"},"url":"https://p10-setup.icloud.com:443","status":"active"},"fmf":{"url":"https://p10-fmfweb.icloud.com:443","status":"active"},"contacts":{"url":"https://p10-contactsws.icloud.com:443","status":"active"}},"pcsEnabled":true,"configBag":{"urls":{"accountCreateUI":"https://appleid.apple.com/widget/account/?widgetKey=12312412412341234123412341234123412341234#!create","accountLoginUI":"https://idmsa.apple.com/appleauth/auth/signin?widgetKey=83545bf919730e51dbfba24e7e8a78d2","accountLogin":"https://setup.icloud.com/setup/ws/1/accountLogin","accountRepairUI":"https://appleid.apple.com/widget/account/?widgetKey=12312412412341234123412341234123412341234#!repair","downloadICloudTerms":"https://setup.icloud.com/setup/ws/1/downloadLiteTerms","repairDone":"https://setup.icloud.com/setup/ws/1/repairDone","vettingUrlForEmail":"https://id.apple.com/IDMSEmailVetting/vetShareEmail","accountCreate":"https://setup.icloud.com/setup/ws/1/createLiteAccount","getICloudTerms":"https://setup.icloud.com/setup/ws/1/getTerms","vettingUrlForPhone":"https://id.apple.com/IDMSEmailVetting/vetSharePhone"},"accountCreateEnabled":"true"},"hsaTrustedBrowser":false,"appsOrder":["mail","contacts","calendar","photos","iclouddrive","notes2","reminders","pages","numbers","keynote","newspublisher","fmf","find","settings"],"version":2,"isExtendedLogin":false,"pcsServiceIdentitiesIncluded":false,"hsaChallengeRequired":true,"requestInfo":{"country":"TH","timeZone":"GMT+7","isAppleInternal":true},"pcsDeleted":false,"iCloudInfo":{"SafariBookmarksHasMigratedToCloudKit":false},"apps":{"calendar":{},"reminders":{},"keynote":{"isQualifiedForBeta":true},"settings":{"canLaunchWithOneFactor":true},"mail":{},"numbers":{"isQualifiedForBeta":true},"photos":{},"pages":{"isQualifiedForBeta":true},"find":{"canLaunchWithOneFactor":true},"notes2":{},"iclouddrive":{},"newspublisher":{"isHidden":true},"fmf":{},"contacts":{}}}'}
+ body:
+ string: '{"success":false,"error":1}'
headers:
- access-control-allow-credentials: ['true']
- access-control-allow-origin: ['https://www.icloud.com']
- access-control-expose-headers: [X-Apple-Request-UUID, Via]
- apple-originating-system: [UnknownOriginatingSystem]
- apple-seq: ['0']
- apple-tk: ['false']
- cache-control: ['no-cache, no-store, private']
- connection: [keep-alive]
- content-length: ['4895']
- content-type: [application/json; charset=UTF-8]
- date: ['Mon, 30 Jul 2018 19:00:39 GMT']
- server: [AppleHttpServer/2f080fc0]
- strict-transport-security: [max-age=31536000; includeSubDomains]
- via: ['icloudedge:si03p00ic-ztde010417:7401:18RC341:Singapore']
- x-apple-jingle-correlation-key: [SJHIUN7879234KJHH8JBH]
- x-apple-request-uuid: [NISUHFIOSUHFOSIDUHFOSIDF]
- x-responding-instance: ['setupservice:328457238759328579234875']
- status: {code: 200, message: OK}
+ Access-Control-Allow-Credentials:
+ - 'true'
+ Access-Control-Allow-Origin:
+ - https://www.icloud.com
+ Cache-Control:
+ - no-cache, no-store, private
+ Connection:
+ - keep-alive
+ Content-Type:
+ - application/json; charset=UTF-8
+ Date:
+ - Fri, 08 Dec 2023 16:37:26 GMT
+ Server:
+ - AppleHttpServer/78689afb4479
+ Strict-Transport-Security:
+ - max-age=31536000; includeSubDomains
+ X-Apple-Edge-Response-Time:
+ - '45'
+ X-Apple-Request-UUID:
+ - e7626cfc-bb0c-4ccd-986d-b9327f8bcef3
+ X-Responding-Instance:
+ - setupservice:44700503:pv51p47ic-qukt21032501:8003:2404B363:5934c9004de5
+ access-control-expose-headers:
+ - X-Apple-Request-UUID,Via
+ content-length:
+ - '27'
+ via:
+ - 631194250daa17e24277dea86cf30319:7ecc2ff259156058e890ba5cf00be461:uschi7
+ x-apple-user-partition:
+ - '47'
+ status:
+ code: 421
+ message: Misdirected Request
version: 1However, the HTTP response code of "421: Misdirected Request" may be the key, and indicate that icloud has updated its API and therefore pyicloud needs updating to reflect that. Back in Oct 2023, someone submitted an issue to pyicloud regarding the 421 response: picklepete/pyicloud#441, and 4 days ago there is a possible fix: picklepete/pyicloud#406 (it's not merged yet) My system:
|
|
Total speculation but I wonder if this has anything to do with Apple's attempts to block iMessage on Android; https://www.theverge.com/2023/12/8/23994089/apple-beeper-mini-android-blocked-imessage-app |
|
My guess is that it has something to do with the recent support for passkey logins. Such a thing would be unusual for an api, nevertheless a change that requires specification of the desired login method sounds very likely. |
This sounds like the issue for me... |
|
Same error here running on Windows x64 with 1.16.3 version |
|
@NGC3982 Make it easier to run. Big thanks to @scaraebeus |
|
Is there a update for the PIP (windows) Version? I don't use docker. Thanks for all the efforts to fix it. Frank |
|
Does anyone know how to apply this fix for docker running in synology nas? |
Not sure on timing for the official update. Unfortunately for my fix to be pulled in, there are a few things that need to be in place on my branch for it to be accepted. I've been working through updating the various tests and code coverage and in doing so I am finding some other parts of the I'm working through it but it will take some time - especially with the holidays coming up. The only option I'm aware of at this time is to consume the auth_fix branch directly if your environment and setup allows you - with the risk that it has yet to be fully tested and vetted. |
|
@scaraebeus thanks a lot for your hard work and dedication. It is well appreciated by many. |
|
@scaraebeus I join previous comment to thank you for your great contribution here, I patched the main branch with #734, built and installed it with pip and got it working on both raspbian/debian bullseye (11) and bookworm (12) . I am also using edits as described in issue #249 so that I can download both edited media (the ones we see on the phone and in iCloud) and original media in a regular cron backup script to my pi-based NAS, which makes this script critical to me. thanks again and congrats for keeping it working ! |
Works on Debian 12 with docker for me until some period of time where the Apple servers either: Additionally, I'm attempting to download over 180k photos, so that might be why apple is hanging up on me periodically. It doesn't explain the 2fa prompt while icloudpd is running and actively downloading though. The expected behavior where re-running icloupd picks up where it left off results in diminishing returns: |
|
Works! For those using the above solution, a minor change is necessary (I'm on macOS): in the Shell script, change ETA: The Edit 2: Don't use |
|
Is saving to the keychain not working for anyone else with the auth_fix branch? Previously I was able to see an option to use a 2FA code instead of SMS |
Steps to reproduce? With the branch I just got a 2FA code on my devices like normal, and it prompted me in the terminal. I don't remember it giving me an option between SMS or 2FA code, though. |
With When I try to save in the keyring it only offers SMS instead of 2FA: Edit: for now I've just resolved myself to running |
|
It appears the command line flow for the base It also appears, from what I can tell, the Based on the above, as you've saved the password in the keyring now, try using the The option to offer saving in the keyring could be moved into the |
|
Previous behaviour was that saving to the keychain required SMS MFA, it did not have an option for Apple's built in MFA. Performing a download would then trigger a second MFA prompt, which had two options for MFA; SMS and Apple. I noticed this behaviour when attempting to relocate the MFA cookie in my container from $HOME/.local to /config. Took me a lot of deletes/recreates to get it working reliably. Edit: I think it's also worth mentioning that I actually had two SMS numbers I could use for three of my containers. I have added my phone number as a trusted number to the three accounts of my family members. This allows me to re-authenticate their containers without me needing access to their devices. Very useful feature. |
The current On top of this, there are two separate endpoints used to validate codes depending on whether the 2SA or 2FA flow is triggered. It's possible the endpoints don't really matter and the same endpoint can be used regardless - I'll have to test. Proposed solution:
|
I think in theory this should work but the code I get via SMS can never be verified successfully: |
|
I retract my statement about the @tanookiben - when you attempt to verify the SMS code, have you also already received an auto-generated code to one of your iDevices? If so, what happens if you enter that code at the prompt instead of the one sent through SMS? This would at give me a bit of a clue as to where there is something end point related and/or if it's still expecting the first code. |
|
I'm not near my laptop to test, but IIRC, mine crashed at the point where it attempted to list the phone numbers. |
|
Update: All test are now passing for the The 2SA/2FA cases noted above will still need to be looked into but I'm hopeful these can be treated as separate issues and allow the core fix to be merged for those that are waiting on this due to various package distribution requirements. Happy Holidays! |
|
1.17.0 released and has the fix |
|
I've built a new container with iCloud 1.17.0, but the behaviour is not the same. I am no longer presented with the option to perform SMS based multifactor authentication. I also receive a warning about it not being able to parse JSON, which I've not seen before but I'm not too worried about, as the application downloads the photos regardless: Is SMS based multifactor authentication no longer possible? |
With the new method used in The way the base I've started working on an enhancement to allow selecting an SMS for 2sa validation. A 2fa code will still be sent to the iDevice automatically, but you should be able to choose an SMS, get a code there, and validate with that instead. If you want to check that out, see the It may be worth starting a separate issue for this to be tracked outside of this thread. |
|
I depend on this tool and have been following this issue. Thanks so much for all the hard work and getting this fixed so quickly. You are appreciated! 🙏 |
Can you share the command you used here? I'm able to save credentials to the keyring with |
|
Just checking in on this issue, tried the lastest release today and it seems like it is still broken. Was #734, supposed to resolve this issue? |
If you see the same issue then post here all details. Otherwise open new issue. |
and others
Overview
As of about 45mins ago, all four of my containers attempted a download, and all four failed to login.
After removing the keyring file and attempting to recreate it with
icloud --username my@email.comthe password is rejected. I've confirmed the e-mail and password combination is correct.Steps to Reproduce
Expected Behavior
Logs into icloud
Actual Behavior
Fails to login. If password is saved to the keyring, this error is generated:
Context
Seems that Apple may have changed something. Can replicate on Alpine Linux 3.18.3 icloudpd 1.16.2 and Alpine Linux 3.18.5 and icloudpd 1.16.3
The text was updated successfully, but these errors were encountered: