Rain Bird IQ4 – New Custom Integration for Cloud-Connected Controllers

Share your Projects! Custom Integrations
62

Hi Sefer,

Those are two separate failures, and neither one clearly points at your password.

Login page failed: HTTP 202 happens on the initial GET of the login page, before any credentials are sent. A 202 there is the signature of the AWS WAF JavaScript challenge; the WAF accepts the request but serves challenge.js instead of the login form. That’s a known issue on my side (#11), not something a new password can fix.

access_token not found in redirect with a URL back on /Account/Login means the login POST went through but the server returned the login page instead of redirecting with the token. On the Web portal channel that error was ambiguous, it covered both rejected credentials and the WAF interfering mid-flow, and the setup dialog showed “Check your credentials” either way.

That ambiguity is fixed in v1.3.3, available now via HACS. A WAF block now says so explicitly, and a genuinely rejected login says that instead. It won’t get you past the WAF, but you’ll at least know which of the two you’re looking at.

After updating, could you check these?

  1. Retry the setup and tell me which of the two new messages you get. That alone narrows it down.
  2. Can you log in at https://iq4.rainbird.com in a normal browser, from the same network? If that also fails, or asks you to accept terms or change the password again, the account is in a state the integration can’t get past.
  3. Try the App channel as well as Web portal; it uses a different OAuth client, and it’s worth knowing whether both are blocked or just one.

One caution: repeated failed setup attempts may well be what triggered the password reset in the first place, so please don’t loop it dozens of times.

And does the new generated password contain any non-ASCII characters? Unlikely to matter, but quick to rule out.

63

Hi KRH1009,

Sorry for the long delay getting back to you, this one slipped past me.

I’ve since run the same check against my own controller, which has no rain sensor wired at all, and that gives us a baseline to compare yours against. Mine reports exactly one entry:

id=... name='Local Sensor' type=-1 model='Rain Sensor Prevent (Alarm)'

with localSensor: -1 on the satellite, and localSensorTypes: [-1, 10, 110, 115, 120, 150, 198, 199] as the list of types the controller accepts. So type: -1 looks like “no local sensor configured”, a placeholder slot that’s always present. The integration filters those out on purpose; otherwise everyone without a sensor would get a phantom rain-sensor entity.

That makes your case the interesting one. Your WR2 receiver wires into the same SEN terminals, so IQ4 ought to report it with one of those real type values. Here’s the script; standalone, read-only, without using Home Assistant:

wget https://raw.githubusercontent.com/davidsuarez82/rainbird_iq4/main/tools/diagnose_sensors.py
pip install curl_cffi
python3 diagnose_sensors.py YOUR_EMAIL

It prompts for the password. Add --channel app if your zone control needs the Mobile app channel.

Run it while the app still shows “Local rain detected” if you can; that’s when the state field should be set. It prints a summary and writes a JSON report next to itself. Coordinates, addresses and serials are redacted by default, but please still skim it before posting.

The printed summary has everything I need, so you can just paste that:

  1. The controller: line, the integration only knows two model ids so far, so I’d like yours for the map.
  2. The sensor list, specifically the type value. Anything other than -1 means the filter isn’t your problem and the bug is further down. If it’s -1 like mine, IQ4 isn’t registering the WR2 as a sensor object at all.
  3. The “Local sensor configuration” block, particularly localSensor, that’s -1 on my sensor-less setup.

Any of those tells me something useful.

64

Hey Chapter
As if v1.3.3 or v1.3.4 (I updated to latest) it is working again.

I couldn’t even login into the app anymore. It was like someone changed the password or they simply disabled it? I don’t know. After a password reset a day ago I was able to login into the app again and now with the update from today it is working again for the integration!

65

Hi Sefer,

Glad it’s working again, but I should be straight with you: it almost certainly wasn’t the update.

Neither 1.3.3 nor 1.3.4 touches the login flow. 1.3.3 only changes which error message you see when a login fails, and 1.3.4 only adds some debug logging for manual zone commands. What fixed it was the password reset.

Your account being locked out of the official app too is the interesting part, and it changes how I read this. That’s not bot protection, that’s Rain Bird locking the account itself. My guess at the sequence: repeated failed logins → Rain Bird locks or invalidates the account → the WAF starts answering 202 to it → password reset clears both.

If that’s right, the 202 isn’t random, it’s what you get once an account is in a bad state. Which points at something I can actually fix: when authentication fails, the integration retries every 30 seconds indefinitely, which is exactly the behaviour that would get an account locked in the first place. Backing off after repeated auth failures would stop it digging the hole deeper. I’ll look into that.

One question, if you remember: between updating and it working, did you ever see an error message mentioning bot protection, or one about the login being rejected? I added both in 1.3.3 and as far as I know nobody’s hit them yet, so I’d like to know they display correctly. No problem if it just worked first time.

66

Hey Chapter
No there never was a bot protection message. On app or web login, I just got “wrong username / password” (something like that).

I only saw something for a split second at around my first message, but it instantly changed to the message I posted. Didn’t see it in the logs unfortunately. When I noticed I can’t login anymore, I tried the app and was logged out (another phone still logged in) and I couldn’t login anymore. Tried the web page, same there. It was a random generated pw, too, so I guess they disabled me. Best explanation I have.

1 Like