fastlane: fastlane cert got Unauthorized Access error

@janpio I was able to authenticate successfully by entering sms when prompted for the 2FA code and selecting the trusted phone number manually (producing a second sms), instead of entering the code that was initially generated.

Wondering if this line could be related https://github.com/fastlane/fastlane/blob/master/spaceship/lib/spaceship/two_step_or_factor_client.rb#L144

i solve with this. when the prompt asked you

“Please enter the 6 digit code:” i type “sms” instead

it will ask you: Please select a trusted phone number to send code to:

1. +62 ••••-••••-••72 ?

and then I enter the 6 digit code I received earlier.

I was facing the issue and I tried changing the pwd from apple login page https://appleid.apple.com/account/manage and select the checkbox. But unsure, if this works for everyone.

This works for me!

What works for me: I did change my password on Apple account and signout from all devices. Then fastlane spaceauth -u “username”, enter “sms” instead of the first code received by Apple, choose my phone number, and then enter the second sms received.

I was facing the issue and I tried changing the pwd from apple login page https://appleid.apple.com/account/manage and select the checkbox. But unsure, if this works for everyone.

@AAverin Multiple people posted the workaround here: Type sms, hit Enter, select the phone to send the code to (if asked) and then enter the second code you are sent.

To be honest it might very well be, that we did not design the 2FA logic in fastlane for the case of “first code already comes via SMS”. But of course it does make sense that this is possible.

@jesiegel1 wants to look into this a bit ❤️

@janpio I was able to authenticate successfully by entering sms when prompted for the 2FA code and selecting the trusted phone number manually (producing a second sms), instead of entering the code that was initially generated.

Wondering if this line could be related https://github.com/fastlane/fastlane/blob/master/spaceship/lib/spaceship/two_step_or_factor_client.rb#L144

thank you. this way works fine. Initial code can not work.

It didn’t work for me the sms solution

I was facing the issue and I tried changing the pwd from apple login page https://appleid.apple.com/account/manage and select the checkbox. But unsure, if this works for everyone.

This worked for me. Changed my password and signed out of all devices then tried again with the new password. Thanks!

@janpio @max-ott Yea sorry, that was unclear (also to clarify the account has 2FA enabled, not 2SV).

Using the Apple ID that was throwing the unauthorized error (made sure to remove the fastlane cookie with each run):

• Logged into iCloud under “Passwords & Accounts” on my phone:
  • ran match, phone displayed the 2FA system prompt, and entering the displayed code authenticated successfully (without inputting sms).
• Signed out of iCloud on my phone:
  • ran match, received sms, and entering the sms code threw the unauthorized error.
  • ran match, received sms, entered sms and selected a trusted phone number, received second sms, and entering the second sms code authenticated successfully.

Can you confirm that logging in with the same account via the website works as expected? Maybe they changed the API again…

Yes, the accounts that showed ‘Unauthorized Access’ worked as expected when I logged in web myself

Since the issue is tied to SMS/call 2FA, I was able to go around it by logging into my developer’s Apple ID from the System Preferences -> Internet Accounts (you can add a secondary Apple account there) and receiving the 2FA code directly in macOS.

We have a PR now that should fix this problem: https://github.com/fastlane/fastlane/pull/16162 The logic is quite complicated, so might take some time to get properly reviewed and merged. If you know ruby, take a look!

@janpio It seems like accounts that aren’t currently logged into any devices (which is the case for my account) will fallback automatically to sms.

I took a quick look in Postman and compared account A (not logged in to a device) to account B (logged into a device), and the behavior seemed to differ:

1. For B, it seems like the system 2FA code gets displayed right after the POST https://idmsa.apple.com/appleauth/auth/signin req is made by the spaceship client, whereas for A an sms gets sent right after the GET https://idmsa.apple.com/appleauth/auth req in handle_two_step_or_factor
2. For A, the response for GET https://idmsa.apple.com/appleauth/auth has a few additional fields including "noTrustedDevices": true and "mode": "sms"

So I’m guessing we need to check for one of those fields, and if present, set the code_type and payload as if the user had entered sms, but without the PUT https://idmsa.apple.com/appleauth/auth/verify/phone req so we don’t generate a second code.

Sounds like it is being caused by Apple’s servers, not fastlane. Unfortunately not much we can do.