Not able to log into my server anymore (4.8.0.80)

[cnstarz 27]

The new update broke all web logins.  Nobody can log in with username and password from a web browser.  My account happens to be still logged in from a previous session and I'm scared to log out because I may not be able to get back in.

As an example: I have an account called "kids".  It's literally for my kids (no content rated R or TV-MA), no password or PIN required at all because they truly don't need one.  I cannot log into this account at all, even with a blank password.  It says "Invalid username or password."  I tried setting the password to "password" -- still can't log in; same error.  I tried rebooting my server.  No dice.

I tried logging into my main account from my Google Shield with a PIN and it isn't working at all.  It also wasn't accepting my password.  I restarted emby and was finally able to log in with a password, but now my PIN isn't working at all.  Now, having been in the cybersecurity and IT for 20 years, I fully understand the importance of having very strong and unguessable passwords -- hence why mine are typically 16-20 characters in length and generated via Bitwarden.  Nobody who is security-conscious should have to type that kind of password using a TV remote every time they open Emby on the TV.  Why don't I just keep my Emby account logged in on my TV?  Because, as mentioned above, I have kids that should not have unfettered access to the entire library.

Guys, respectfully, what in the world did this update do?  It was huge, but it broke the most necessary function: authentication.

How do I get my users to log in, and how do I keep my kids safe from the entire library while also not requiring me to type in my strong password every single time?

Edited February 5, 2024 by cnstarz

[Luke 42079]

Hi, did you try using the forgot password process?

Quote

My account happens to be still logged in from a previous session and I'm scared to log out because I may not be able to get back in.

Is this an admin? If so then you can go in and set passwords for all of the users.

[cnstarz 27]

Just now, Luke said:

Hi, did you try using the forgot password process?

Is this an admin? If so then you can go in and set passwords for all of the users.

The forgot password process tells me to contact my administrator -- which is me.

As I stated above, I did set the password for my kids account.  Emby is not accepting it.  It's not accepting a blank password either.  To be clear, I changed their password from a blank password to "password".  But when I try logging into my kids account with the new "password" password, it says "Invalid username or password.  Please try again."

[cnstarz 27]

I just tried creating a brand new account and setting the password to "password".  I cannot log into that new account either.  I'm trying all of this on mobile and desktop.

Edited February 5, 2024 by cnstarz

[Luke 42079]

6 minutes ago, cnstarz said:

The forgot password process tells me to contact my administrator -- which is me.

As I stated above, I did set the password for my kids account.  Emby is not accepting it.  It's not accepting a blank password either.  To be clear, I changed their password from a blank password to "password".  But when I try logging into my kids account with the new "password" password, it says "Invalid username or password.  Please try again."

Can you please attach the emby server log? There could be something else going on. Thanks.

[cnstarz 27]

Yes, i'll grab it in a sec.  As a note, none of these failed authentications are showing up under Activity in the server dashboard.

[cnstarz 27]

Server log attachedembyserver.txt

[cnstarz 27]

I think I just found the cause for my kids account -- it was set up to only allow logins from specific devices.  I'm gonna have to track down my wife to see if she enabled that cuz I certainly didn't. 

Okay, now how do I get the shield app to accept my PIN?

[Luke 42079]

Quote

I think I just found the cause for my kids account -- it was set up to only allow logins from specific devices.  I'm gonna have to track down my wife to see if she enabled that cuz I certainly didn't.  https://cdn.jsdelivr.net/gh/twitter/twemoji@14.0.2/assets/72x72/1f926.png

Right I would strongly suggest not using this feature. It's something we should have never added but it's been hard to get rid of due to the few people who do use it.

[Luke 42079]

Quote

Okay, now how do I get the shield app to accept my PIN?

Two things to know:

• The pin is not the same anymore. It is now called a Profile Pin and has a slightly different function, and this is explained on the user password configuration screen
• To use it on the Shield, install our standard android app, which is also in the store for it: https://emby.media/emby-for-android.html

[cnstarz 27]

1 minute ago, Luke said:

Two things to know:

• The pin is not the same anymore. It is now called a Profile Pin and has a slightly different function, and this is explained on the user password configuration screen
• To use it on the Shield, install our standard android app, which is also in the store for it: https://emby.media/emby-for-android.html

Is there supposed to be an update to the Android app?  If so, that could take days to over a week before some devices see it in the play store.

[Lessaj 467]

The latest version should be 3.3.65 from February 2 but I'm also opted into the beta for the app so you'd have to check in your play store what it says.

[rbjtech 5284]

10 hours ago, Luke said:

Right I would strongly suggest not using this feature. It's something we should have never added but it's been hard to get rid of due to the few people who do use it.

May I ask why ?

This feature implies extra control to restrict access to certain devices - ie I want to restrict access to a childs use of emby on the playroom tv only - I don't want them to use the same login and password on lets say a phone.

It can also be used to restrict an Admin account to use certain devices only - ie a weak form a multi factor authentication, albeit an easy one to bypass if you know the device id in question as I believe that is sent in plain text, but it's better than no restrictions at all.

[Luke 42079]

17 hours ago, rbjtech said:

May I ask why ?

This feature implies extra control to restrict access to certain devices - ie I want to restrict access to a childs use of emby on the playroom tv only - I don't want them to use the same login and password on lets say a phone.

It can also be used to restrict an Admin account to use certain devices only - ie a weak form a multi factor authentication, albeit an easy one to bypass if you know the device id in question as I believe that is sent in plain text, but it's better than no restrictions at all.

Because it has some awkwardness to it. You have to first grant them access to everything so that they can login, then restrict after that.

If later you forget that you applied this restriction, then it leads to sign in problems.

[rbjtech 5284]

5 hours ago, Luke said:

Because it has some awkwardness to it. You have to first grant them access to everything so that they can login, then restrict after that.

If later you forget that you applied this restriction, then it leads to sign in problems.

On a new devices yes - as you then assign it a unique device id, but on an existing device - you simply have to restrict them first and then they can only sign in on that device.

The awkwardness is there if you untick 'all devices' because the default is for every device to still be ticked - if you untick 'all devices', you probably want to restrict by device, so the default should be untick all the devices and then manually tick the one(s) you want ..

I personally think it's a really useful function - to restrict emby usage per user on only the devices you specify.

Web browsers need a bit of work - because unless you give them custom names - they all appear as the same name.  Appending the machine hostname name would be nice

 

[Luke 42079]

@cnstarzare you all set now?

[cnstarz 27]

23 hours ago, Luke said:

@cnstarzare you all set now?

Until Google Play decides to give me the latest version of the app, I'm stuck with just staying logged in on the Shield and trusting that my kids aren't watching rated-R or TV-MA material.  It works, but it's not as ideal as before the update.

[cnstarz 27]

On 2/4/2024 at 8:05 PM, Lessaj said:

The latest version should be 3.3.65 from February 2 but I'm also opted into the beta for the app so you'd have to check in your play store what it says.

I'm stuck on v2.0.98g. Play Store shows no updates available. I've tried uninstalling and reinstalling emby, and rebooting the Shield.

How do you opt into the beta?

[GrimReaper 4740]

1 minute ago, cnstarz said:

I'm stuck on v2.0.98g. Play Store shows no updates available.

That is latest stable release, as you're not enrolled in beta there' are no updates.

Quote

2.0.98 (27 Oct) Release

• More buffer adjustments
• Update Google Play billing library

3 minutes ago, cnstarz said:

How do you opt into the beta?

You can also sideload beta apk:

 

 

[cnstarz 27]

Wait a second, the only way for PINs to work on the Shield is if you're enrolled in Beta testing specifically for the Shield app, even though this feature has already been rolled out to the Stable branch of Emby Server?  So the stable client app is no longer compatible with the stable server app?

Edited February 7, 2024 by cnstarz

[GrimReaper 4740]

3 minutes ago, cnstarz said:

Wait a second, the only way for PINs to work on the Shield is if you're enrolled in Beta testing specifically for the Shield app

No, currently you need to use standard Android app (which is different from AndroidTV client app), as you've already been advised:

On 2/5/2024 at 1:38 AM, Luke said:

Two things to know:

• The pin is not the same anymore. It is now called a Profile Pin and has a slightly different function, and this is explained on the user password configuration screen
• To use it on the Shield, install our standard android app, which is also in the store for it: https://emby.media/emby-for-android.html

 

[Luke 42079]

It's coming very soon for Android TV.

[cnstarz 27]

Just now, GrimReaper said:

No, currently you need to use standard Android app (which is different from AndroidTV client app), as you've already been advised:

 

Right, so the stable AndroidTV client app, which is the only Emby app in the Android TV Play Store, is no longer compatible with the stable Emby server branch?

[Luke 42079]

1 minute ago, cnstarz said:

Right, so the stable AndroidTV client app, which is the only Emby app in the Android TV Play Store, is no longer compatible with the stable Emby server branch?

It is compatible, just a little behind on features. We are working on unifying the two apps into one.

[cnstarz 27]

8 minutes ago, Luke said:

It is compatible, just a little behind on features. We are working on unifying the two apps into one.

Respectfully, Luke, it's not compatible if you relied on using a PIN to protect your account (or to protect your children).  I'm glad you guys are working to unify the two apps, but truly, this feature should not have been rolled out to the stable server branch until all stable client apps became fully compatible.  Lesson learned hopefully.

Edited February 7, 2024 by cnstarz