Categories
Personal Computing Technology

UniFi OS Login Issue

The good folks at Ubiquity overlooked Murphy and his Laws when they designed the new UniFiOS authentication system. The change has system integrators up in arms and looking for alternatives. What did Ubiquity do and what are the consequences?

The good folks at Ubiquity have revised the architecture of the UniFi software system to provide a uniform user management and login environment for Network, Protect, Access, and the coming Talk.

A roles based access rights scheme greatly simplifies user administration and has greatly reduced the number of UniFi related passwords in 1Password. So, life is good in paradise? Not really. Read on to learn of the unanticipated consequences.

Revisions

  1. 2021-03-23 Original and minor edits including addition of references 4 and 5.

References

  1. UniFi Cloud Key firmware 2.0.27
  2. https://oauth.net/2/
  3. https://www.oauth.com/
  4. https://www.washingtonpost.com/nation/2021/03/06/texas-power-plants/
  5. https://spectrum.ieee.org/energywise/energy/the-smarter-grid/what-texas-freeze-fiasco-tells-us-about-future-of-the-grid

Truth and Consequences

UniFi has modified the Cloud Key and Dream Machine software system to support single system sign-on using OAUTH. OAUTH2 provides a uniform user authentication system designed for use by network applications, local applications, local AV devices, and local things. By using OAUTH, Ubiquity has established a uniform sign-in process for both local and remote access of the installation’s administration features and user features. This is a great advance over the the prior situation but has introduced a regression relative to the prior implementation.

OOPS, a Regression

In the prior implementation, it was possible to log in with the UniFi.UI.COM user name and password or a local user name and password. In the prior implementation, it was necessary to maintain both UI.COM and local user credentials.

The use of the OAUTH reference implementation has taken away the redundant user management issue but also the local sign-on ability. The System Integrator community has reacted harshly on YouTube and in SI forums to a “loss of control” and “loss of ownership” But client functionality and value have also been lost.

Now Required to have a UniFi.UI.COM account

All deployments are now required to have a https://ui.unifi.com/ account and Internet access. Apparently, this is a requirement even to commission a deployment before Internet service has been installed on site and provisioned. This is an issue for integrators servicing new construction installations.

Required to have UniFi.UI.COM access to log in

Logging in now requires access to https://unifi.ui.com to log in. If there is an Internet fade (there are never Internet fades, iniit?), you get this happy result.

Login attempted without Internet Service

Reconnect the Internet link to the USG router, hit enter, and login happens. But, it appears a site is dead in the water admin wise until Internet service is restored.

Implications

This design decision has the following implications.

  • Must device adoption and network test be deferred until after Internet service is installed and provisioned?
  • The installation must be associated with someone’s UniFi account.
  • How do you turn over an installation from installation contractor to management contractor or owner?
  • How do owner staff log in to view Protect footage during an Internet fade?
  • Does Talk provide intercom functionality during an Internet fade?
  • Can the owner or a management agent add an LTE secondary Internet service link during an Internet fade?

If something can’t go wrong, it will anyway!

All of us who are actual engineers have met Professor Murphy, his Lemma, and its Corollaries.

  1. If anything can go wrong, it will.
  2. If something just can’t go wrong, it will anyway.
  3. When things appear to be going better, you’ve overlooked something.

It’s a fact of life that stuff happens. In Texas in February, winter bit and bit hard the Texas utilities and their regional transmission operator. The Texas electric power disruption was a direct result of owner hubris and bad owner decisions while building out natural gas production and electric power generating stations. An earlier outage in 2011 caused similar failures and resulted in a hot wash and after action report with recommendations. The gas producers and power producers binned the report without action. Among the bad things that happened are the following.

  • Numerous utility scale generating stations failed because natural gas gathering lines froze up. These on-grade lines were not heat traced.
  • Retail gas production installation gathering lines and product separation systems froze up because they were not heat traced.
  • Coal generating stations were forced into outage when the coal pile and coal handling equipment froze up.
  • Wind turbines ordered without anti-icing systems (most of them) were forced into outage.
  • Snow covered residential and utility solar panels alike because there was no anti-icing.
  • Working utility scale generating stations were forced into outage to maintain gas service for home heating customers as demand exceeded supply and system pressure sagged.
  • Numerous utility scale generating stations were forced into outage because condensate systems, reserve feed water system, and cooling water systems etc were not heat traced. Cooling towers iced up.
  • Ice and motor vehicle accidents severed retail distribution.
  • Ice pulled down business and residence power service feeders
  • Ice pulled down business and residence Internet service connections.
  • Network utility and customer backup power systems failed as natural gas pressure dropped or Diesel generator sets exhausted their bunkered fuel.
  • Fuel oil distributors could not keep up with delivery demands from large backup generators.

Replace ice with hurricane, earthquake, or wild-fire and similar large scale disruptions are possible. Short term outages and multi-day outages are very possible. Granted the Texas event was a once per 10 year occurrence, but stuff happens.

What is needed?

It is desirable that Ubiquity’s products make a reasonable effort to maintain local capabilities in the absence of off-site communications. What can owners reasonably expect?

  • They can log in to the network controller to review the system status and event logs.
  • They can provision a redundant Internet link.
  • They can work with cameras and video in Protect.
  • Access doors continue to work and they can continue to manage door credentials.
  • That their TALK phones continue to function for internal and campus calls.