Access to WLAN password
KetchupBomb opened this issue · comments
When you load the Unifi Controller > Network web UI, you can navigate to WiFi, load an individual network, and peek at the password in plain text:
Within the Unifi API Browser, the closest Collection I can find is list wlan configuration, but there is no reference to the WLAN password in the output.
Is there another Collection I should be viewing? Is this field something the Unifi API Browser can gain access to?
The key to look for is x_passphrase.
@malle-pietje , there is no x_passphrase key in the list wlan configuration Collection. Is it in another Collection? The only key in list wlan configuration that has "pass" in its name is radius_macacl_empty_password.
Is this field only accessible through the Unifi API Client?
Edit: The Unifi API Client also doesn't list this field with the ->list_wlanconf() call. I'll keep searching other API Collections, but I think this question needs another answer since x_password isn't seemingly available.
@KetchupBomb it should actually be there if the SSID is protected with a WPA2 password/passphrase.
@KetchupBomb If this is password to be entered through the captive portal you can find it in the guest_access section of the list site settings output.
I personally find the new interface very confusing when it comes to setting up guest networks and always switch to the classic interface to get access to all controls.
@malle-pietje, this is a WPA2 network that I made on the UDM-Pro web UI. It is not associated with any captive or guest portals. And the "x_passphrase" is definitely not present -- both the API Browser web UI, and the API Client do not list this key for any of my WiFi networks.
Is there a PHP recipe I can run to convince you? Is there additional information I can provide to debug why it's not showing when it seems like it should be?
No need to convince me😉 Can you share a screenshot of the list of wireless networks using the classic interface?
Also, which version of the Network Application are you running and which UDM firmware version?
UDM-Pro Unifi OS Version: 1.10.4
Unifi Network Version: 6.4.54
The WiFi in question is "Aperture Science" (though they're all configured the same, save the network/VLAN with which they're associated). Images attached.
Here's the JSON WLAN configuration for Aperture Science in the API Browser (the API Client seems to be very similar, if not exactly the same):
{
"_id": "REDACTED",
"ap_group_ids": [
"REDACTED"
],
"enabled": true,
"fast_roaming_enabled": false,
"hide_ssid": false,
"name": "Aperture Science",
"networkconf_id": "REDACTED",
"pmf_mode": "disabled",
"usergroup_id": "REDACTED",
"wlan_band": "both",
"wpa_enc": "ccmp",
"wpa3_support": false,
"wpa3_transition": false,
"wpa3_fast_roaming": false,
"wpa3_enhanced_192": false,
"group_rekey": 0,
"uapsd_enabled": false,
"mcastenhance_enabled": false,
"no2ghz_oui": false,
"bss_transition": true,
"proxy_arp": false,
"l2_isolation": false,
"b_supported": false,
"dtim_mode": "default",
"minrate_ng_enabled": true,
"minrate_ng_data_rate_kbps": 6000,
"minrate_ng_advertising_rates": false,
"minrate_na_enabled": false,
"minrate_na_data_rate_kbps": 6000,
"minrate_na_advertising_rates": false,
"mac_filter_enabled": false,
"mac_filter_policy": "allow",
"mac_filter_list": [],
"radius_mac_auth_enabled": false,
"radius_macacl_format": "none_lower",
"security": "wpapsk",
"wpa_mode": "wpa2",
"radius_das_enabled": false,
"site_id": "REDACTED",
"iapp_enabled": true,
"auth_cache": false,
"bc_filter_enabled": false,
"bc_filter_list": [],
"country_beacon": false,
"dpi_enabled": false,
"element_adopt": false,
"is_guest": false,
"p2p": false,
"p2p_cross_connect": false,
"radius_macacl_empty_password": false,
"rrm_enabled": false,
"sae_groups": [],
"sae_psk": [],
"sae_psk_vlan_required": false,
"schedule": [],
"schedule_enabled": false,
"schedule_reversed": false,
"schedule_with_duration": [],
"tdls_prohibit": false,
"vlan_enabled": false,
"optimize_iot_wifi_connectivity": true,
"dtim_ng": 1,
"dtim_na": 3
}
OK, I fired up the UDM PRO in our test lab and can see the password for a newly created SSID using the API Browser tool:
{
"_id": "6187d73ff392af04e887cac5",
"enabled": true,
"wpa3_support": false,
"wpa3_transition": false,
"security": "wpapsk",
"wep_idx": 1,
"wpa_mode": "wpa2",
"wpa_enc": "ccmp",
"pmf_mode": "disabled",
"pmf_cipher": "auto",
"usergroup_id": "6107bdff7fe01f067b62b78e",
"wlan_band": "both",
"ap_group_ids": [
"6107bdff7fe01f067b62b798"
],
"dtim_mode": "default",
"dtim_ng": 1,
"dtim_na": 3,
"minrate_ng_enabled": false,
"minrate_ng_advertising_rates": false,
"minrate_ng_data_rate_kbps": 1000,
"minrate_na_enabled": false,
"minrate_na_advertising_rates": false,
"minrate_na_data_rate_kbps": 6000,
"mac_filter_enabled": false,
"mac_filter_policy": "allow",
"mac_filter_list": [],
"bc_filter_enabled": false,
"bc_filter_list": [],
"group_rekey": 3600,
"hotspot2conf_enabled": false,
"bss_transition": true,
"auth_cache": true,
"schedule_enabled": false,
"name": "My test WPA SSID",
"x_passphrase": "dezeisgeheim",
"networkconf_id": "6107bdff7fe01f067b62b78d",
"radius_das_enabled": false,
"site_id": "6107bdf97fe01f067b62b77a",
"iapp_enabled": true,
"x_iapp_key": "40c5a28515861cc58685abfe39db3942",
"optimize_iot_wifi_connectivity": false,
"dtim_6e": 3,
"wlan_bands": [
"2g",
"5g"
]
}
The SSID was created through the Classic interface like so:
Versions are:
- UDM firmware: 1.11.0-16
- Network Application: 6.5.50
The same applies to our software-based controller running version 6.4.54.
The only remaining thing I can think of is the permissions of the admin account you're using to connect through the API.
The only remaining thing I can think of is the permissions of the admin account you're using to connect through the API.
You're right. I set the account to be "View Only" initially. When I switch it to "Administrator" (or "Site Admin"), I am able to see the x_password field. I may have missed documentation that points this out (sorry!). It's strange that this nuance of read vs write permissions causes some fields to display or not. 🤷♂️
Thanks for your patience and help.
Thanks for the feedback, good to hear. Will add a note to the README for the PHP API client to reflect your findings (not something I’d seen before myself).
@malle-pietje, btw, I bet this is exactly what was happening in Art-of-WiFi/UniFi-API-client#129.
cc @NickDunas
Yes, correct. I've added a note on this to the README files for both the API Client and the API Browser. Thanks for your help with this!