Advanced Data Protection Support about icloud-photos-sync HOT 17 OPEN

@krubenok I've created #207 for the addition of YubiKey support - but I'll need help on that.

from icloud-photos-sync.

Makes sense! Whenever I get a chance I'll get you that file. Thanks for being responsive 😄

from icloud-photos-sync.

@gsong are you using iCloud Shared Photo Library?

from icloud-photos-sync.

@gsong are you using iCloud Shared Photo Library?

No, I'm not.

from icloud-photos-sync.

I'm in a similar position with advanced data protection and a yubikey on my Apple ID. With this combination of security settings, the sign in prompts I receive on other devices don't have MFA codes, but rather just "ok" or "that wasn't me".

Edit; this feels like something that might have a soft dependency on #120 to do yubikey auth via a webUI.

from icloud-photos-sync.

@gsong Any of those things enabled with you as well?

Otherwise your use case @krubenok would be a separate issue - however: I currently don't have an account setup like this (neither do I plan to do so). Most importantly, in a scenario, where Advanced Data Protection is enabled, the possibility to access your data from the WebUI needs to be enabled (this can be done optionally) - as this tool is using the APIs used by the WebUI.

In case you want me to investigate your use case further, I'd need an HAR file from your authentication against the iCloud WebUI - based on that I might be able to understand what needs to change in order to support this - #120 is not related. (Full disclosure: Keep in mind that this HAR file might contain sensitive data - unless you know how to purge it, you need to trust me that I won't abuse this - however since the MFA trust token is location/IP specific I probably won't be able to use the data from those requests anyway)
See #207

from icloud-photos-sync.

I just realise I was skipping over this part @gsong

Note that I do have Advanced Data Protection turned on.

You will need to make sure that access through the iCloud WebUI is enabled. See Apple's support document on this. The tool is re-using those APIs (and I hope the APIs are the same when this is enabled, since I cannot test this).

Please report back - in case it does not work, I would need to ask the same of you as above.

from icloud-photos-sync.

Hiya, I'm trying to set this tool up and I have Advanced Data Protection enabled on my iCloud account. I'm currently getting the following error when I try running the token command:

APP_TOKEN (FATAL): Unable to acquire trust token caused by AUTH_FAILED (FATAL): iCloud Authentication failed caused by ICLOUD_PHOTOS_SETUP_FAILED (FATAL): Unable to get iCloud Photos service ready caused by ICLOUD_PHOTOS_SETUP_ERROR (FATAL): Unexpected error while setting up iCloud Photos caused by Request failed with status code 403 (Error Code: cadf49b6-85c4-47b4-84a4-ced655765a67)

I've made sure that I have the "Access iCloud Data on the Web` option enabled in my account settings.

Let me know if I could provide you with more information to help troubleshoot this as I do not want to disable ADP.

from icloud-photos-sync.

@noah-guillory which 2FA method are you using.

Does the WebUI access work (have you ever accessed the UI from a non Safari browser, where you provided password instead of Touch ID)

from icloud-photos-sync.

@noah-guillory which 2FA method are you using.

Does the WebUI access work (have you ever accessed the UI from a non Safari browser, where you provided password instead of Touch ID)

I am using the normal 2FA method, not using any hardware security keys or anything.

I was able to get through the process of providing my 2FA code by curling it to the MFA endpoint.

And I am able to access Photos from the WebUI using Edge as well. Though whenever I do, I do get a push notification on my Mac saying that my device is providing access to the iCloud web interface.

from icloud-photos-sync.

Do you need to confirm this notification before being able to continue?

from icloud-photos-sync.

I need to understand how the API behaves differently from the current process, when ADP is enabled.

Best way for me to debug is by being able to see the iCloud API's behaviour here. For that I'd need a HAR file of your login on the browser. For that do the following:

1. Open a new private window in Chrome
2. Navigate to icloud.com
3. Open the Network Tab of the Developer Tools (e.g. right click on the page and select 'Inspect')
4. On the Dev Tools Network select 'Preserve log' and 'Disable cache'
5. Clear the log and make sure logs are recorded
6. Perform login and open iCloud Photos
7. Once done, 'Download har' file
8. Sent it to me so I can take a look at what's happening - feel free to sent it to my email [email protected]

Example of how to do this:

from icloud-photos-sync.

Hi @steilerDev, is there any hope of ADP support landing soon? Did you get the input you needed?

from icloud-photos-sync.

@Tomfox91 unfortunately I have not received any feedback on my previous request - so I have not had the chance to implement this.

from icloud-photos-sync.

Thanks @Tomfox91 for sending over an HAR file - I just had a quick look - some things look different, but the good news is that the API is very close to what I am expecting :)

Unfortunately I'm not sure when I'll get around working on this as private and professional life are currently taking a lot of time :/ Anyone who wants to support on this, I'm happy to point you into directions :)

from icloud-photos-sync.

Sadly I think the resolution to this issue is to buy a used / refurb m1 Mac mini.

from icloud-photos-sync.

@skaeight looking at the previously shared HAR files by @Tomfox91 I don't think this will be necessary (as long as you allow iCloud Access through the WebUI)

from icloud-photos-sync.