DS-2DE4A425IWG-E ONVIF - "The action requested requires authorization and the sender is not authorized" error?

[magma1447]

Has anyone else experienced that onvif sometimes (seemingly random) doesn't work due to authentication errors?

I have several cameras, but only my DS-2DE4A425IWG-E seems to act out like this. I am using onvif-cli to debug why Frigate wasn't working, and have realized that it sometimes (almost every time) decides that it doesn't like the authetication.

root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
False: Unknown error: The action requested requires authorization and the sender is not authorized
root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
True: OrderedDict([('Manufacturer', 'HIKVISION'), ('Model', 'DS-2DE4A425IWG-E'), ('FirmwareVersion', 'V5.8.0'), ('SerialNumber', 'DS-2DE4A425IWG-E20220824CCWRK47482644'), ('HardwareId', '88')])
root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
True: OrderedDict([('Manufacturer', 'HIKVISION'), ('Model', 'DS-2DE4A425IWG-E'), ('FirmwareVersion', 'V5.8.0'), ('SerialNumber', 'DS-2DE4A425IWG-E20220824CCWRK47482644'), ('HardwareId', '88')])
root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
True: OrderedDict([('Manufacturer', 'HIKVISION'), ('Model', 'DS-2DE4A425IWG-E'), ('FirmwareVersion', 'V5.8.0'), ('SerialNumber', 'DS-2DE4A425IWG-E20220824CCWRK47482644'), ('HardwareId', '88')])
root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
True: OrderedDict([('Manufacturer', 'HIKVISION'), ('Model', 'DS-2DE4A425IWG-E'), ('FirmwareVersion', 'V5.8.0'), ('SerialNumber', 'DS-2DE4A425IWG-E20220824CCWRK47482644'), ('HardwareId', '88')])
root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
False: Unknown error: The action requested requires authorization and the sender is not authorized
root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
False: Unknown error: The action requested requires authorization and the sender is not authorized
root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
False: Unknown error: The action requested requires authorization and the sender is not authorized
root@7dc07210d8f0:/# /root/.local/bin/onvif-cli --host cam-13 --port 80 --user test4 --password asdf1234 devicemgmt GetDeviceInformation
False: Unknown error: The action requested requires authorization and the sender is not authorized

For some reason it does work sometimes. Yesterday I ran the command before going to bed, failed like most others. This morning I ran it with success four times in a row. Then 15 minutes later it didn't work again. Two days ago I managed to get it to answer once, but not more.

I have tried two firmware versions. Both being V5.8.0, one was built spring last year, and the one I am using now late last year (build time). If you know of a newer firmware for this camera, please point me to it. But since a v5.8.0 was built just a few months back I assume that it is the latest.

I have tried rebooting the camera. I have removed Onvif users, and added new ones. That's why the name above is test4. I have disabled the "Illegal Login Lock" feature. Nothing else should be connecting to the camera, except my Hikvision NVR, which is working, and is using the admin login account. Most of all, nothing else is using these onvif test accounts. I have been letting it rest for a full night, tried rebooting again and so on.

The onvif command devicemgmt GetCapabilities works every single time. But GetDeviceInformation and GetProfiles seldom works, I have tried hundreds of times.

Any suggestions?

 

[David]

@magma1447,
Could there be a random conflict between the ONVIF versions communicating with each other? The intermittency seems strange.

What operating systems / apps are you using?

David

 

[magma1447]

I doubt that it has to do with the versions. I am no expert with Onvif, far from it. But by reading the standard it seems extremely simple in the concept of sending commands and getting information back. Also, I have the issue both from Frigate and from onvif-cli.

I have successfully communicated with my other two (Hikvision) cameras that are installed.

onvif-cli is Python, which I am running in a Docker instance based on Debian. I have also tested from my laptop with Ubuntu, and my Desktop with Ubuntu. This is my Docker container:

$ cat Docker/onvif-cli/Dockerfile
FROM debian:unstable-slim
MAINTAINER Magnus Månsson "magma@1447.se"

RUN \
apt-get update && \
apt-get install -y python3 pipx && \
pipx install onvif_zeep && \
apt-get clean && \
rm -rf \
/tmp/* \
/var/lib/apt/lists/* \
/var/tmp/*

ENTRYPOINT ["/root/.local/bin/onvif-cli"]

 

[Kyle]

I have tried two firmware versions. Both being V5.8.0, one was built spring last year, and the one I am using now late last year (build time). If you know of a newer firmware for this camera, please point me to it. But since a v5.8.0 was built just a few months back I assume that it is the latest.

It looks like the one you're currently using is the latest (build 231109, on Hikvision's product page for the camera).
There are some other earlier versions here, so it might be worth trying these to see if they're any better for you?

 

[Phil]

Clutching at straws here, but have you tried a 'strong' password?

 

[magma1447]

Clutching at straws here, but have you tried a 'strong' password?

I am not sure to be honest. I created a "real" account first, and that didn't work. I didn't really pay attention to if Hikvision considered it strong. Since it sometimes works I don't really believe it in it either. But regardless, it's a reasonable suggestion and also easy to test, so I did.
$ docker run onvif-cli --host cam-13 --port 80 --user freGJA2342 --password poiJKN872. devicemgmt GetDeviceInformation
False: Unknown error: The action requested requires authorization and the sender is not authorized

Doesn't work though.

I will test an older firmware tomorrow. Don't have time for potential unexpected issues right now. I do believe I had a reason to upgrade to 5.8.0 though. But regardless, it would be very interesting to know if it works in 5.7.x.

 

[David]

I am not sure to be honest. I created a "real" account first, and that didn't work. I didn't really pay attention to if Hikvision considered it strong. Since it sometimes works I don't really believe it in it either. But regardless, it's a reasonable suggestion and also easy to test, so I did.
$ docker run onvif-cli --host cam-13 --port 80 --user freGJA2342 --password poiJKN872. devicemgmt GetDeviceInformation
False: Unknown error: The action requested requires authorization and the sender is not authorized

Doesn't work though.

I will test an older firmware tomorrow. Don't have time for potential unexpected issues right now. I do believe I had a reason to upgrade to 5.8.0 though. But regardless, it would be very interesting to know if it works in 5.7.x.

definitely worthwhile rolling the firmware back, would a protocol analyser like Wireshark help? You may get more detail on the error.

David

 

[magma1447]

I installed an onvif Android app (Onvier), it has zero issues communicating with the camera.

The onvif-cli still works sometimes. It might be safe to assume that Frigate has borrowed code from that, or use the same library. I haven't investigated that.

I tried downgrading firmware to 5.7.3, but the camera refused.

I also did some tcp dumping and got to the conclusion that it returns 400 Bad Request when requesting /onvif/Events. The next request is /onvif/device_service which then also fails. It has given me something more to Google about, but this far no luck. It's however some form of progress to know that there is an Android app that works all the time.

Maybe the camera is doing something partly off the standard. Or maybe the implementation in onvif-cli and Frigate is faulty. Right now I am stuck again so I will have to leave it for a few days. Maybe I'll come up with some other idea. Thanks for the input I have received though.

 

[Phil]

Clutching at another straw - are all the network connections 'wired'?
We have in the past seen inexplicable failures to successfully update firmware when using a wireless laptop.
Most things work. most of the time - you think your WiFi is solid, but ...

Same can apply if there are Powerline adapters in-play in the setup.

 

[magma1447]

Everything is wired properly. It's a professional network which also includes online hosting.

 

[magma1447]

Things have been resolved, and it's so stupid that I regret saying it.

I had googled before I went here, and I had found that the time in the camera could be an issue. I thought I had double checked the time in the camera, but after turning on NTP things got resolved. I probably had checked the wrong camera... Regardless the time itself was almost correct, so it was a bit sensitive. I had NTP configured in the other cameras, so this was some mistake while setting it up a year ago.

 

[Phil]

Glad that you have resolved it.
Thanks for coming back and sharing the solution.