What would be required to enable SSO?

[danieledwardgeorgehitchcock]

Hi,

I have just ordered my Bird Buddy and am looking at integrating it in to my HA setup.

When creating my account I used google SSO which I can see this project doesn't currently support.

Before stumbling across this project, I decompiled the APK and found the graphQL API and endpoints that you have found.

I have some basic Python skills but a lot of skill working with and authenticating with RESTful API's as well as less structured API's such as graphQL.

I am wondering if there is anything I can do to help you add the other auth methods into this project, or have you already investigated it and hit a dead-end?

[jhansche]

The main roadblock is obtaining a Google access token using the app's oauth client info. I have that info, but have not spent much time trying to obtain an access token with that info.

It's a web client, so trying to set up our own wrapper page to do the oauth exchange and get the token would work in general, but the credential is restricted, so it will only allow it from certain domains (like mybirdbuddy.com) or app ids (com.birdbuddy.app) and app signature fingerprint. That's the last attempt I made, and stopped looking into it at that point.

Just extracting the access token is only part of the issue, because we also need it to be able to refresh that access token automatically, or at least make it easy/transparent to the HA user.

The issue is not with authenticating to the GraphQL API: sending the auth token is extremely easy to do once we have it. The problem is obtaining the Google SSO access token that the API will be able to use.

I don't have a lot of experience with how the backend will take that access token and decode or validate it, but I'm fairly certain that it will only work if it was generated for the same credential that they're using on the backend, which is via web client id: 1084463568247-3rgct5vvu418t611hp4hv5clmm1gm0lh.apps.googleusercontent.com

I've tried to create an oauth flow that attempts to obtain an access token for that web client id, but ran into a few issues:

1. The web page has to be remote, cannot be a file:/// URL
2. The web client credential is restricted to a domain, most likely mybirdbuddy.com
3. The app does this just by using the Google SSO SDK, which would be easy to verify, but that only works if the app is signed with their official release signing key. So patching the app to enable debug support (to monitor network requests and bypass certificate pinning) means it's a new key, and that is why the patched app is unable to obtain the access token.

If you know of any tricks to obtain a Google SSO access token authorized for the above client id, then I am certainly happy to accept PRs to enable that!

I don't know anything about Apple's SSO, and did not look into Facebook's SSO. It was just simpler for v1 to limit support to email+password.

---

I'm sure you already know all of this, so just bear with me - mostly reiterating here, for future readers:

As for the current state of this project, if you want to have owner access support from this component in the meantime, your best option (especially before you start building a large BB collection like I did), is to reset your BB unit and re-pair it with a new account created with email+password. That's what I ended up doing, effectively orphaning all my old collections.

The 2nd option (which I was doing for a while before resetting and re-pairing), is to make a new email+password account, and use an invitation code from the app on the SSO owner account, so that the email+password guest account can access the feeder. That still works, but it has limited functionality: no firmware version info, no ability to perform firmware updates, no distinction between certain offline states ("out of feeder" and "off the grid" both appear as just "offline"), no access to put it off-grid. All the postcard and collection behaviors still work fine though, since the postcards and collections are account-based, not feeder-based.

[jhansche]

By the way, kudos on finding the GraphQL info. I've been an Android developer for over 10 years, and it took me a while to find all that 😄