Question about account passwords

[hotwheelzffx 20]

I have four profiles on my server. Right now, two of those display the profile icons at the logon screen when connecting remotely. Those two accounts are valid Emby Connect users. When remotely connecting to my server, I can select/click those profiles and logon without a password prompt. Is this correct behaviour? A third user account is a local account without an Emby Connect account. That profile does prompt me to enter a password at the logon screen when connecting remotely.

I do have one error in the logs that may be unrelated.

2020-10-06 09:28:32.218 Error HttpClient: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><s:Fault><faultcode>s:Client</faultcode><faultstring>UPnPError</faultstring><detail><UPnPError xmlns="urn:schemas-upnp-org:control-1-0"><errorCode>718</errorCode><errorDescription>ConflictInMappingEntry</errorDescription></UPnPError></detail></s:Fault></s:Body></s:Envelope>
2020-10-06 09:28:32.228 Error HttpClient: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><s:Fault><faultcode>s:Client</faultcode><faultstring>UPnPError</faultstring><detail><UPnPError xmlns="urn:schemas-upnp-org:control-1-0"><errorCode>714</errorCode><errorDescription>NoSuchEntryInArray</errorDescription></UPnPError></detail></s:Fault></s:Body></s:Envelope>
2020-10-06 09:28:32.231 Error PortMapper: Error creating port map
*** Error Report ***
Version: 4.5.1.0
Command line: C:\Users\userxxx\AppData\Roaming\Emby-Server\system\EmbyServer.dll
Operating system: Microsoft Windows 10.0.19041
Framework: .NET Core 3.1.8
OS/Process: x64/x64
Runtime: C:/Users/userxxx/AppData/Roaming/Emby-Server/system/System.Private.CoreLib.dll
Processor count: 8
Data path: C:\Users\userxxx\AppData\Roaming\Emby-Server
Application path: C:\Users\userxxx\AppData\Roaming\Emby-Server\system
MediaBrowser.Model.Net.HttpException: MediaBrowser.Model.Net.HttpException: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><s:Fault><faultcode>s:Client</faultcode><faultstring>UPnPError</faultstring><detail><UPnPError xmlns="urn:schemas-upnp-org:control-1-0"><errorCode>714</errorCode><errorDescription>NoSuchEntryInArray</errorDescription></UPnPError></detail></s:Fault></s:Body></s:Envelope>
at Emby.Server.Implementations.HttpClientManager.CoreHttpClientManager.SendAsyncInternal(HttpRequestOptions options, String httpMethod)
at Emby.Server.Implementations.HttpClientManager.CoreHttpClientManager.SendAsync(HttpRequestOptions options, String httpMethod)
at Mono.Nat.Upnp.UpnpNatDevice.GetSpecificMappingAsync(Protocol protocol, Int32 publicPort, CancellationToken cancellationToken)
at Mono.Nat.Upnp.UpnpNatDevice.CreatePortMap(Mapping mapping, CancellationToken cancellationToken)
at Emby.PortMapper.ExternalPortForwarding.CreateRules(INatDevice device, CancellationToken cancellationToken)
Source: Emby.Server.Implementations
TargetSite: Void MoveNext()

[ebr 16193]

Hi.  Have you logged into those accounts previously and selected the "Remember me" option?

[hotwheelzffx 20]

I just kind of noticed this behaviour today. I've not had a reason to logon to those other accounts so I probably did not click Remember me. In the house (locally) via Roku on her TV, my daughter could not remember her profile's password and simply clicked on another profile (Emby Connect user) and got right in without a password prompt.

[ebr 16193]

Have you set the option to not require a password on the local network?  Are you sure you created passwords for these accounts?

There are a lot of ways to tailor how logins happen.  If you want to secure accounts, you can do it and if you want to make them easier you can also do that.  This is all under your control in either the User setup or on the app itself.

[hotwheelzffx 20]

The Emby Connect users do not have that option to not require a password on the local network. My local accounts do require a pin on the local network. I don't know how you guys do this, but if local User A logs onto the local network and then signs out and is still able to choose a another Emby Connect profile, is there some sort of cached auth cookie/session ID that is allowing the bypass of logon/pass? I would think Emby Connect users would require a challenge regardless of local/remote logon.

[Luke 42085]

There isn't' really a distinction of type of user. Once you link them to your server, they become a user on your server and you can manage the local login mechanism just like other users.

[hotwheelzffx 20]

See attached for what I see on local vs Emby Connect users. I confirmed this with an external user. From their location, having never logged into Emby before, they were able to connect and click on the Dad profile icon and get straight into the Emby server with no password.

[pwhodges 2014]

That looks to me as if Dad has no password (it's not got a space for Current Password above the New Password fields).  That would make it unsurprising to be able to use that account without a password...

Paul

[hotwheelzffx 20]

OK. So regardless if they are an Emby Connect user, you ALWAYS have to set a password. That would be their "local" password and has no effect on their Emby Connect password?

Is that the correct SOP?

[Happy2Play 9783]

19 minutes ago, hotwheelzffx said:

That would be their "local" password and has no effect on their Emby Connect password?

Correct as they are two different accounts even though the can/are linked together.

[Carlo 4561]

Hi, if you can't get this worked out on your own, I can remote in and give you a quick hand with the user setup and help you test a few accounts.

One things that can cause you an issue on rare occasions is if Emby is interpreting your "remote" logins as local and applying local permissions. You can quickly spot this looking at the IP in the activity on the dashboard.

If in doubt about "saved" passwords try logging in with a completely different browser that you never use.  The browser will not have any cookies or credentials this way.

[Luke 42085]

@hotwheelzffx has this helped?

[hotwheelzffx 20]

Yes. Just had to set a local password for everybody.