[tado] Support multiple homes & accounts, and bug fixes

[andrewfg]

This PR does the following:

• Relating to discussion here [tado] Tado changes their OAuth2 flow from 'password' to 'device' per 15 March 2025 #18340 (comment) it adds support for multiple homes and accounts
• Relating to [regression] OH Core OAuth synchronization error openhab-core#4698 it breaks the thread-lock loop
• Relating to discussion here https://community.openhab.org/t/tado-authentication/163276/47 it re-starts the authentication if the prior refresh token is no longer accepted.

Signed-off-by: Andrew Fiddian-Green software@whitebear.ch

The Jar files for testing are here:

• org.openhab.binding.tado-4.3.4-SNAPSHOT.zip
• org.openhab.binding.tado-5.0.0-SNAPSHOT.zip

[andrewfg]

Ping @OlduwanSteve just for info: I have tested this myself on my own system insofar as is possible without having two accounts. At least I can confirm that a) it does not break anything for users with one account, and b) it can authenticate a (single) account regardless of whether a user name is specified. I suggest you look at the new docs -- note that you need to check the Advanced box to see the new configuration parameters for this feature.

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/tado-authentication/163276/54

[andrewfg]

@OlduwanSteve there is also a build for OH v4.3.4 above

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/many-items-stop-responding-after-a-while-since-upgrade-to-oh-4-3-4/163498/18

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/tado-authentication/163276/56

[andypmuc]

Hello, I also support this pull request and though of starting programming it. I have 3 tado devices distributed of VPN to be handled by one OpenHAB instance. I have also this error, when I click on authenticate. I have update several times and currently from 4.3.3 to 4.3.4. If I install a new instance, I have no problem. Regards Andreas

HTTP ERROR 500 com.google.gson.JsonIOException: Failed making field 'java.lang.Throwable#detailMessage' accessible; either increase its visibility or write a custom TypeAdapter for its declaring type.
URI:	/tado
STATUS:	500
MESSAGE:	com.google.gson.JsonIOException: Failed making field 'java.lang.Throwable#detailMessage' accessible; either increase its visibility or write a custom TypeAdapter for its declaring type.
SERVLET:	org.openhab.binding.tado.internal.servlet.TadoAuthenticationServlet
CAUSED BY:	com.google.gson.JsonIOException: Failed making field 'java.lang.Throwable#detailMessage' accessible; either increase its visibility or write a custom TypeAdapter for its declaring type.
CAUSED BY:	java.lang.reflect.InaccessibleObjectException: Unable to make field private java.lang.String java.lang.Throwable.detailMessage accessible: module java.base does not "opens java.lang" to unnamed module @7b83aec6

[andrewfg]

I have also this error, when I click on authenticate.

Please provide logs as follows:

• log:set TRACE org.openhab.core.auth
• log:set TRACE org.openhab.binding.tado

[andypmuc]

Sorry to ask this question, but where do I do this? In the GUI?

[andrewfg]

In the console.

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/tado-authentication/163276/58

[OlduwanSteve]

@andrewfg Great stuff, it works like a charm! I dropped the 4.3.4 snapshot jar in my addons folder, stopped the openhab service, cleared the cache, started the service again. My two bridges showed as pending config and each correctly prompted me with the user parameter pre-filled in the url.

One nice thing to note is that the tado OAuth confirmation for the second bridge recognised I was already logged in with one account, and gave me the option to logout before proceeding.

I'm very grateful for you jumping on this.

[andrewfg]

the tado OAuth confirmation for the second bridge recognised I was already logged in with one account, and gave me the option to logout before proceeding.

Indeed. And I suspect that if you had not logged out of account A and logged in to account B, then it would have invalidated the prior token for account A.

[andypmuc]

Maybe it was the cache not emtpied ...

[andrewfg]

When I started Openhab from the cmd it worked, only when Openhab was running as a service it did not work.
Either way, I catch following message

@andypmuc you are saying confusing things. On one hand you say it works, but on the other hand you say it reports an error. Which is it?

In any case, the exception that you see (OAuthConnectorRFC8628.fetchAccessTokenResponse(OAuthConnectorRFC8628.java:358) means that OH did perfectly succeed in getting a valid device code from the Tado server on https://login.tado.com/oauth2/device_authorize but then the exact same Tado server on https://login.tado.com/oauth2/token rejected with HTTP 400 (bad request) to convert that device code into an access token. i.e. the error is coming from the Tado server. => So maybe you have some issue with your Tado account?

As a result of your log, I see that I do need to make the OH Core error logging more gentle. (Which I will do). However the underlying issue seems to be coming from the Tado server. So can you please turn on log:set TRACE org.openhab.core.auth and post the results?

---

EDIT see openhab/openhab-core#4703

[andypmuc]

What I said, was the truth, tested it several times. Now I have the problem, that the scanning of devices of the remote VPN Tado system is not working. Is there another way, to find out the ID?

[andrewfg]

the scanning of devices of the remote VPN Tado system is not working

Sorry but I don't understand. Can you please explain further?

What I said, was the truth, tested it several times

So if the log that you provided above applies identically to the case when it succeeded and also to the case when it failed, then obviously that log provides us with no information to help discern what failed. Or??

---

Probably if you could provide the log you would see a message “The authorization request is still pending” this means that you did not complete the login process on the Tado website. Perhaps because you used the wrong login credentials, or perhaps because you did not press the submit button.

---

EDIT: see this https://community.openhab.org/t/tado-authentication/163276/65

[andrewfg]

Your refresh token is trashed. So you will need to manually erase it. There is a file \\OPENHABIAN\openHAB-userdata\jsondb\StorageHandler.For.OAuthClientService.json where you should delete the tado:home entries. You should stop OH then edit the file, then restart again. Make a backup just in case.

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/oh-5-0-0-snapshot-some-bindings-with-external-connectivty-stop-working/163570/2

[andrewfg]

@andypmuc please see this post https://community.openhab.org/t/tado-authentication/163276/71

[andypmuc]

Now it works.
To explain my problem better, I have two networks 192.168.0.x and 192.168.1.x. Openhab is running on 192.168.1.x and one TadoBridge in 192.168.1.x, two other bridges in 192.168.0.x and the networks are connected via Wireshark VPN of two Fritzboxes. The bridge in 192.168.1.x is found, is there a way to add the two bridges in 192.168.0.x?

I have the two bridges in, because I have them from my old configuration, but I lost two zones and there is no way to get their ID or scan for them (I deleted them because of com problems). When I set up a new Openhab, I do not have the possibility to add anything from the other network, does this request solve this?

[lsiepel]

Well, that is more or less generic networking. openHAB can add any devices as long as it is able to connect to it.
Auto discovery might be a problem for those remote networks, not sure. So you might need to find the remote ip address, a different way.

[andrewfg]

is there a way to add the two bridges

If both Tado hubs present themselves on your network then the OH discovery will find them and put them in the inbox. (If not then you have a LAN routing issue that is unrelated to this thread).

Normally when you only have one Tado hub it is only necessary to set the useRfc8628 configuration parameter to cause RFC-8628 authentication. But if you have more than one hub, it needs a marker to differentiate between them, so you must also configure rfcWithUser and account username separately for each hub. And when you authenticate via the servlet remember to login with that respective account user name.

https://github.com/openhab/openhab-addons/blob/9f4d367efc37a471d1527f8572b291f9e7efcffd/bundles/org.openhab.binding.tado/README.md#home-thing-the-bridge

[andypmuc]

I think I wait for the rfcWithUser feature, this will solve it easily.

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/many-items-stop-responding-after-a-while-since-upgrade-to-oh-4-3-4/163498/30

[andrewfg]

@lolodomo I think this one is ready to merge. (It has been verified by @OlduwanSteve and @andypmuc)

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/tado-add-on-only-works-with-one-bridge-since-openhab-version-4-3-4/164042/2

[lsiepel]

Thansk @andrewfg i have some questions that might improve the user experience (or not) :-)

[lsiepel]

Thanks, LGTM