Ombi does not report the users ip wuen authenticating with emby.

[Darkassassin07]

Describe the bug
When a user imported from emby authenticates; the authentication event (whether failed or successful) shows the IP of the OMBI instance instead of the IP of the user (displayed in embys dashboard under activity/alerts).

This behavior is the same when directly connected to ombi, as well as when connected via nginx with
"proxy_set_header X-Real-IP $remote_addr;" set.

As far as I can tell, the only way to find the correct IP currently is to manually dig through ombis log files and match up the time stamps with embys events.

To Reproduce
Log in with an emby user. Look at embys events.
Expected behavior
The ip reported in emby should be the ip of the user that's authenticating. It is instead the ip of the ombi instance.

Desktop (please complete the following information):

• OS: Win 10 pro.

Ombi Version (please complete the following information):

• Ombi 4.38.1
• Emby server 4.7.11.0
• Database Type: SQLite

[github-actions]

Hi!

Thanks for the issue report. Before a real human comes by, please make sure you used our bug report format.

Have you looked at the wiki yet? https://docs.ombi.app/

Before posting make sure you also read our FAQ.

Make the title describe your issue. Having 'not working' or 'I get this bug' for 100 issues, isn't really helpful.

If we need more information or there is some progress we tag the issue or update the tag and keep you updated.

Thanks!

Ombi Bot.

[sephrat]

I'd like that too, but this is only feasible if it's supported by Emby server. They may only take into account the actual IP address that made the request, which will always be the one of Ombi server.
I'll ask around if there's a special header we can use to pass the end user IP address.

[Darkassassin07]

When logging into emby via a nginx reverse proxy (outside of ombi, just logging in directly), if "proxy_set_header X-Real-IP $remote_addr;" is not used, emby uses the ip of the nginx instance, similar to what it's doing with ombi.

My assumption is ombi is not using this header when connecting to emby where it could be, but I may be wrong. Somewhere to start at least.

Thanks for looking into this.

[sephrat]

I tried X-Forwarded-For and X-Real-IP, it all yielded the same result: Emby displayed my actual IP instead of the one I gave.
I'm not an expert in that area though, that's why I'll ask them. You're also welcome to try and play with the API yourself if you're savvy enough. The endpoint we use is /emby/users/authenticatebyname.

[sephrat]

Also there's one drawback that this could bring: at the moment Ombi is counted as a single device by Emby. I'm wondering if passing the actual IP would result in Emby counting multiple devices (one per device connected to Ombi), thus risking of reaching the device limit for Emby Premiere. This would be a no-go.

[Darkassassin07]

Huh, That's the first I'm hearing of ombi counting towards/requiring emby premier. That's not really mentioned anywhere I can see. I do see now, it shows up as a device in embys device manager.

Looking through embys terms (https://emby.media/premiereterms.html) the only part that seems to cover it is "A 'Premiere Device' is defined as any mobile, computer, or other electronic device which registers with the Emby server with a unique 'device id'. The device id is a uniquely generated id that is dependent on both device model, OS version, and application."

So long as ombi maintains the same DeviceID (which doesn't seem to be dependent on ip), it should be alright.

[sephrat]

Yes, there's an FAQ for it here: https://emby.media/support/articles/Premiere-Limits.html

I managed to make it work! ✌️ Turns out there's a limit in Emby: it only supports X-Forwarded-For for external IP addresses so that you cannot bypass the remote connection rules you may have set up. I was using a local IP address when first testing so it wouldn't work.
From my first tests, it looks like Ombi still counts as a single device despite logging in with several users and IP addresses, so that's good news. I will ask for confirmation from the developers that only the DeviceID drives this behaviour before looking into a PR for this.

[Darkassassin07]

Fantastic news! Appreciate the quick responses/resolution. Keep up the great work m8 :)