Enable discovery for spotify connect to allow other accounts on the network?

[matthijskooijman premium]

matthijskooijman premium

9. Juli 2019 at 22:15 #46238

(this is a repost of this topic. I just posted it twice before, but editing it seems to *sometimes* make the post disappear somehow…)

I’ve been using the spotify connect plugin (not the Spotty squeezebox plugin which does not suit my setup) and have found it to behave erratically. After a while, I discovered that the plugin passes --disable-discovery to librespot, preventing access from other spotify accounts (which probably explains the erraticness I’ve seen). Is this intentional?

AFAIU, Spotify connect works like this:

• When librespot starts, it connects to the spotify servers, authenticating using the credentals configured (if any).
• All other clients using the same credentials can see the device in their list and control it,. AFAICT, control always goes through the spotify servers.
• When discovery is enabled, librespot advertises its presence using multicast DNS (zeroconfig/avahi/bonjour) to anyone on the local network. It also opens up a dedicated HTTP server that allows anyone on the local network to query device information and transfer authentication to librespot.
• When a local Spotify client (using a *different* account) connects to librespot, it sends over some authentication tokes that allow librespot to authenticate to the spotify servers *using the other account*. After this, the local spotify client can (again through the Spotify servers) control librespot. It does seem this authentication is slightly different than the original authentication, since *other* spotify clients using the same account but not on the local network cannot control librespot in this way.

In any case, when discovery is disabled (as it is now), this means that *only* spotify clients using the same account as the one specified in the plugin settings can control librespot. This is unlike what Spotty does, which does allow all local clients (when „Spotify connect“ is checked), so that added to my confusion.

Fixing this seems to be as simple as removing --disable-discovery from /etc/init.d/librespot, which is running just fine here now. In the actual plugin, I think this would be nice to add as an option, so people can decide whether or not to allow other local clients access.

Additionally, as you can deduce from the above, it is not actually *needed* to provide login credentials to librespot at all. If you do not (but *do* enable discovery), then librespot will initially not connect to spotify but just advertise itself. As soon as a local spotify client connects and authorizes librespot, only then will librespot connect to spotify.

I also tested this. Just making the username/password fields empty is not sufficient, since then you get empty values in /opt/max2play/audioplayer.conf:

SPOTIFYCONNECT_PARAMETER=--username --password "" --device hw:sndrpihifiberry

This confuses librespot, making it panic with:

Password for --password: thread 'main' panicked at 'called Result::unwrap() on an Err value: Os { code: 25, kind: Other, message: "Inappropriate ioctl for device" }', libcore/result.rs:945:5

However, if you just remove the --username and --password option entirely, then it works perfectly as described above.

[matthijskooijman premium]

matthijskooijman premium

9. Juli 2019 at 22:20 #46240

Note, to really test that librespot does not authenticate without a username and password, also remove its /tmp/credentials.json cache file. I suspect (but have not verified) that when restarting librespot after some local connection was made, it reuses the previous authentication from that file.

[flysurfer Moderator]

flysurfer Moderator

10. Juli 2019 at 16:39 #46254

Hi matthijs,

thanks a lot for your effort to describe everything in detail!

I had a closer look on our implementation and changed the things you mentioned:
– disable discovery is now optional
– username / password are optional

Just get the latest Beta and click the reinstall button at the bottom of the Plugin page. Your current settings (username/password) will not show up after an update and need to be reentered.

Your feedback on these changes is very welcome!

This will probably help some people – thanks again for your post!

All the Best
Stefan

[matthijskooijman premium]

matthijskooijman premium

11. Juli 2019 at 22:13 #46293

Cool, thanks for the superswift response and update 🙂

I’ve installed the beta plugin on a few boards and it works like a charm, excellent! I would suggest adding a bit more explanation to the discover option. Perhaps something like „When discovery is enabled, anyone on the local network can control the player. When it is disabled, it can only be controlled from the account set above.“?

Somewhat related, when I clicked the reinstall button in the Spotify Connect tab, I got this message: „Something went wrong in last Install Attempt – Deleting Progressfile“. I’ve seen this on all three pi’s I’ve done the update on, but I believe I’ve also seen it before the update, so it might be unrelated to this update.

[matthijskooijman premium]

matthijskooijman premium

11. Juli 2019 at 22:21 #46294

Hm, I also *think* that either updating the plugin (using the beta url), or reinstalling spotify connect removes the -C 5 option from squeezelite, since I had to re-add that in two or all three installations just now.