Core: Wink component not able to use full OAuth for authorization

[missedtheapex]

Home Assistant release (hass --version): 0.44.1 (and earlier)

Python release (python3 --version): 2.7.9

Component/platform: Wink

Description of problem: Wink component is unable to use full OAuth authentication due to requesting the password grant type. Wink apps do not permit the password grant type according to Wink support and their API documentation.

I am able to use an authorization token, but of course it expires every so often and requires manual refreshing. I can use the email/password method to grab a new token every reboot of HASS, but I would prefer a method that doesn't require a reboot just because I have a few weeks of uptime. Unfortunately, the way the Wink component is configured, it requests and authorization type that Wink says they do not support.

The Wink component is requesting the password grant type, per the following lines from pywink's api.py:

    data = {
        "client_id": client_id,
        "client_secret": client_secret,
        "grant_type": "password",
        "email": email,
        "password": password
    }

When I sent the properly formed JSON request to the server myself, I get a response back that reads:

invalid_grant: This client is not permitted to use the password grant type.

Maybe this was different in the past. I got my client id and client secret through Wink's new app request process. ( http://developer.wink.com/ ). It was brand new when I got my client app approved earlier this month, and I've never been able to use the ID and Secret with HASS. When I emailed Wink support about it, I got the following response:

The password grant type is not supported for the security of our users. You will need to obtain an access token for the account using the OAuth standard. Please check out our API documentation for more information: http://docs.winkapiv2.apiary.io/#reference/oauth

Beyond the link above, we do not offer developer support.

Expected:
Update the Wink component to use a different means to get full OAuth authorization.

Problem-relevant configuration.yaml entries and steps to reproduce:

wink:
  email: !secret wink_email
  password: !secret wink_password
  client_id: !secret wink_client_id
  client_secret: !secret wink_client_secret

Traceback (if applicable):

 File "/srv/homeassistant/lib/python3.4/site-packages/homeassistant/components/wink.py", line 119, in setup
    pywink.get_subscription_key())
  File "/home/homeassistant/.homeassistant/deps/pywink/api.py", line 252, in get_subscription_key
    response_dict = wink_api_fetch()
  File "/home/homeassistant/.homeassistant/deps/pywink/api.py", line 271, in wink_api_fetch
    raise WinkAPIException("401 Response from Wink API.  Maybe Bearer token is expired?")
pywink.api.WinkAPIException: 401 Response from Wink API.  Maybe Bearer token is expired?

Additional info:

[w1ll1am23]

Well dang, thanks for the troubleshooting. This was different in the past. The original client_id and client_secrets that were sent out in the past worked with a grant type of password. This would be why I keep seeing more people report this in the forums. Take a look here https://community.home-assistant.io/t/wink-client-id-client-secret-setup-isnt-working/17024/21 I was assuming Wink's new portal was broken, but it sounds like they just changed things and didn't really say anything. They do that a lot.

I'll take a look at this ASAP.

[missedtheapex]

Good to know it's not just me. I did y even think I check the forums. I just knew I couldn't find a related issue already listed.

Thanks for adding the tags. I should have at least make the Wink tag myself...

Let me know if you need any help to sort out this issue (if it's even sort-out-able). I'm here for whatever you need.

[elupus]

I had to do OAuth2 with refresh support for Nibe stuff i've been playing around with: https://github.com/elupus/hass_nibe, there are also several other components in hass that do some oauth authentication.

There really is a need for a generic system within home assistant.