Struggling with Auth and Docker

[KiLLeRRaT]

Summary

Auth keeps asking for an iCloud password in Docker

Context

I've tried setting up a docker run with this:

docker run -it --name icloudpd -v /mnt/data-icloudpd:/data -e  TZ=Pacific/Auckland icloudpd/icloudpd:latest icloudpd --directory /data --username something@something.com --watch-with-interval 3600

This asks for iCloud password, goes through the 2FA successfully and syncs the photos.

If I stop this container, and later run it with docker start icloudpd, and view the logs, I see the message iCloud Password:

I have also tried manually adding my account to the keyring of this container by doing:

docker exec -it icloudpd /bin/sh

and then inside this container:

./exec auth add something@something.com

This command executes without errors, but when I run the container with docker start icloudpd, and view the logs, I see the message iCloud Password: again.

Are you able to let me know what I'm doing wrong?

Thanks!

[boredazfcuk]

In the unofficial container I use, adding the password to the keyring is done with the icloud commands in a subdirectory of /opt. Probably lives at /bin/icloud in your official container.

[AndreyNikiforov]

instead of using keyring, i mount folder for cookies into docker. that way on restarts i can avoid mfa in many cases, but still have to enter password

[KiLLeRRaT]

instead of using keyring, i mount folder for cookies into docker. that way on restarts i can avoid mfa in many cases, but still have to enter password

Do you have to enter the password every time you sync?

[AndreyNikiforov]

i enter password only once i restart iclodpd with new version

[boredazfcuk]

instead of using keyring, i mount folder for cookies into docker. that way on restarts i can avoid mfa in many cases, but still have to enter password

If I restart my container a lot of times in quick succession, it will re-authenticate to Apple servers over and over, and then I get promoted to re-authenticate via MFA again.

I've noticed that the cookie sometimes holds information about the session inside it, would it not be possible for icloudpd to check the cookie for this session info, then re-use it, instead of repeatedly authenticating on startup?

I've managed to get my container looping through albums and downloading by name, problem is, it re-authenticates each time, triggering MFA re-auth if there are about a dozen or more albums to download. Reusing the session info on each launch would solve this problem, I think.

[AndreyNikiforov]

instead of using keyring, i mount folder for cookies into docker. that way on restarts i can avoid mfa in many cases, but still have to enter password

If I restart my container a lot of times in quick succession, it will re-authenticate to Apple servers over and over, and then I get promoted to re-authenticate via MFA again.

I've noticed that the cookie sometimes holds information about the session inside it, would it not be possible for icloudpd to check the cookie for this session info, then re-use it, instead of repeatedly authenticating on startup?

I've managed to get my container looping through albums and downloading by name, problem is, it re-authenticates each time, triggering MFA re-auth if there are about a dozen or more albums to download. Reusing the session info on each launch would solve this problem, I think.

Using cookies (if present) instead of starting with fresh authN would be a valuable feature for frequent app restarts.

[mritd]

I also encountered the same problem.

I don't understand why I still need to re-complete the 2FA authentication even though I have stored the cookie;

if 2FA authentication is forced every time, it means that we have to run the program manually every time instead of continuously running in the background.

[mritd]

I think we can save some authentication information to force authentication when using it for the first time, and then only need to complete the authentication again when the 2FA authentication expires.

There are some conflicts with the current behavior:

1. 2FA requires the use of TTY interactive input
2. Re-authentication is required when restarting
3. The program loses the possibility of continuous running in the background

[AndreyNikiforov]

My thoughts on authn:

• 2FA re-auth is triggered by Apple to the best of my knowledge, so we have to account for that flow (==cannot store key)
• TTY for input does not work with non-interactive use cases (e.g. running docker without restarts)
• 2FA with FIDO may need more than TTY for authn
• One way to solve all these concerns for the mentioned use case may be a creation a web front end for entering password, 2fa key/fido
• reading stored cookies and not forcing auth flow with user/password may help reduce the need for password

[mritd]

Sorry, I misunderstood; after several tests, 2FA authentication has disappeared and it is indeed controlled by Apple.

[ilium007]

Struggling with the same issue

[mritd]

@ilium007 According to my understanding, you can try to mount the cookie file and run it manually multiple times... After a certain time or number of times, Apple will unblock it (2FA is no longer needed).

[AndreyNikiforov]

since 1.20.0 icloudpd saves passwords to keyring after successful authentication and since 1.21.0 supports webui for password and MFA code. doc for more details

Reopen if needed