Authentication Changes in 4.1.0.3

[PenkethBoy 2063]

I was having issues with a script authenticatingbyname (username and password) with the Emby server

 

The script would work fine with 4.1.0.2 but failed with 4.1.0.3

 

Giving the following error

2019-01-28 13:42:20.110 Error HttpServer: Error processing request
    *** Error Report ***
    Version: 4.1.0.3
    Command line: C:\Users\Media\AppData\Roaming\Emby-Server\system\EmbyServer.dll -noautorunwebapp
    Operating system: Microsoft Windows NT 6.2.9200.0
    64-Bit OS: True
    64-Bit Process: True
    User Interactive: True
    Processor count: 4
    Program data path: C:\Users\Media\AppData\Roaming\Emby-Server
    Application directory: C:\Users\Media\AppData\Roaming\Emby-Server\system
    System.ArgumentNullException: System.ArgumentNullException: String reference not set to an instance of a String.
    Parameter name: s
       at System.Text.Encoding.GetBytes(String s)
       at Emby.Server.Implementations.Library.DefaultAuthenticationProvider.GetHashedString(User user, String str)
       at Emby.Server.Implementations.Library.UserManager.AuthenticateLocalUser(String username, String password, String hashedPassword, User user, String remoteEndPoint, CancellationToken cancellationToken)
       at Emby.Server.Implementations.Library.UserManager.AuthenticateUser(String username, String password, String hashedPassword, String remoteEndPoint, Boolean isUserSession, CancellationToken cancellationToken)
       at Emby.Server.Implementations.Session.SessionManager.AuthenticateNewSessionInternal(AuthenticationRequest request, Boolean enforcePassword, CancellationToken cancellationToken)
       at MediaBrowser.Api.UserService.Post(AuthenticateUserByName request)
       at Emby.Server.Implementations.Services.ServiceExecGeneral.GetTaskResult(Task task)
       at Emby.Server.Implementations.Services.ServiceHandler.ProcessRequestAsync(HttpListenerHost appHost, IRequest httpReq, IResponse httpRes, ILogger logger, String operationName, CancellationToken cancellationToken)
       at Emby.Server.Implementations.HttpServer.HttpListenerHost.RequestHandler(IRequest httpReq, String urlString, String host, String localPath, CancellationToken cancellationToken)
    Source: System.Private.CoreLib
    TargetSite: Byte[] GetBytes(System.String)

I traced this back to the password provided in the body of the authentication request

 

Historically the password was provided as either a SHA1 or MD5 hash 

The newer way is to provide the password as plain text as noted in the Api wiki

 

My script is "old" and i had not added the plain text password - hence the failure

 

Until 4.1.0.3 the SHA1 and MD5 hash was still working

 

So - is the removal of support for SHA1 and MD5 hash an intentional change???

 

Could these changes account for the issues users are reporting in this thread - https://emby.media/community/index.php?/topic/68968-4103-local-users-with-blank-password-cant-login-through-some-apps/

[Luke 37008]

There is a defect in that beta version of the server, but yes, please see our wiki to learn about changes that apps needed to make for April of last year:

 

https://github.com/MediaBrowser/Emby/wiki/User-Authentication

 

We announced these changes in the fall of 2017 and gave apps over six months to update.