Support openid connect like authentication providers #32926

elupus · 2020-03-18T10:13:10Z

Breaking change

Proposed change

Add support for using OAuth2/OpenId authentication providers like google, facebook

Type of change

Dependency upgrade
Bugfix (non-breaking change which fixes an issue)
New integration (thank you!)
New feature (which adds functionality to an existing integration)
Breaking change (fix/feature causing existing functionality to break)
Code quality improvements to existing code or addition of tests

Example entry for `configuration.yaml`:

# Example configuration.yaml for google openid provider
homeassistant:

  auth_providers:
    - type: openid
      name: "Google"
      client_id: "1234"
      client_secret: "4567"
      configuration: https://accounts.google.com/.well-known/openid-configuration
      emails:
        - "[email protected]"

# Example configuration.yaml for auth0 provider supporting a multitude of underlying providers
homeassistant:

  auth_providers:
    - type: openid
      name: "Auth0"
      client_id: "1234"
      client_secret: "4567"
      configuration: https://xxx.auth0.com/.well-known/openid-configuration
      emails:
        - "[email protected]"

Additional information

This requires changes in frontend to work correctly with external flows.

Users are whitelisted based on their (verified) email address. That however does require the email scope of openid, which we don't really need. Also email is not really considered a "stable" identifier. That said, the link between a home assistant user and the "upstream" user is based "sub" (subject) identifer. So even if email where to change, we'd still keep the link to same home assistant user.

This PR fixes or closes issue: fixes #
This PR is related to issue: Support external step in login flow frontend#5258
Link to documentation pull request:

Checklist

The code change is tested and works locally.
Local tests pass. Your PR cannot be merged unless tests pass
There is no commented out code in this PR.
I have followed the development checklist
The code has been formatted using Black (black --fast homeassistant tests)
Tests have been added to verify that the new code works.

If user exposed functionality or configuration variables are added/changed:

Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

The manifest file has all fields filled out correctly.
Updated and included derived files by running: python3 -m script.hassfest.
New or updated dependencies have been added to requirements_all.txt.
Updated by running python3 -m script.gen_requirements_all.
Untested files have been added to .coveragerc.

The integration reached or maintains the following Integration Quality Scale:

No score or internal
🥈 Silver
🥇 Gold
🏆 Platinum

homeassistant/auth/providers/openid.py

bdraco · 2020-03-19T18:17:12Z

@elupus Looking good. Let me know when this is ready for testing

homeassistant/helpers/config_entry_oauth2_flow.py

stale · 2020-04-29T05:07:21Z

There hasn't been any activity on this pull request recently. This pull request has been automatically marked as stale because of that and will be closed if no further activity occurs within 7 days.
Thank you for your contributions.

elupus · 2020-04-29T05:17:27Z

It is mainly lacking some comments on solution and on how to proceed. Not really stale.

elupus · 2020-05-10T12:45:38Z

@bdraco if you are interested in testing. it's about as done as i'm likely to get for now. The annoying thing is that there are fewer openid providers than i thought when i started this endever.

elupus · 2020-05-10T13:46:59Z

Auth0 was quite nice to use as a wrapper. The free plan allow two active authentication providers.

bdraco · 2020-05-10T15:46:06Z

@elupus Looks like this needs a rebase for the new external_url / internal_url changes

2020-05-10 15:45:03 WARNING (MainThread) [homeassistant.components.http] Detected use of deprecated `base_url` property, use `homeassistant.helpers.network.get_url` method instead. Please report issue for http using this method at homeassistant/components/http/__init__.py, line 136: for frame in reversed(extract_stack()):
2020-05-10 15:45:09 WARNING (MainThread) [homeassistant.components.http] Detected use of deprecated `base_url` property, use `homeassistant.helpers.network.get_url` method instead. Please report issue for http using this method at homeassistant/components/http/__init__.py, line 136: for frame in reversed(extract_stack()):
2020-05-10 15:45:12 WARNING (MainThread) [homeassistant.components.http] Detected use of deprecated `base_url` property, use `homeassistant.helpers.network.get_url` method instead. Please report issue for http using this method at homeassistant/components/http/__init__.py, line 136: for frame in reversed(extract_stack()):

Happy to test afterwards.

elupus · 2020-05-10T16:01:24Z

Yea, but should still work I think, but I'll rebase it.

bdraco · 2020-05-10T16:52:00Z

I gave this a shot using https://developers.google.com/identity/protocols/oauth2/openid-connect

  auth_providers:
    - type: openid
      name: "Google"
      client_id: "<SNIP>"
      client_secret: "<SNIP>"
      configuration: https://accounts.google.com/.well-known/openid-configuration
      emails:
         - "<SNIP>"

This is what I see and clicking the button returns to same page.

elupus · 2020-05-10T16:54:28Z

@bdraco should be rebased. it prefers external url if set. but should work with internal url too if no external is set.

I forgot to mention, you also need the frontend pull. so a custom frontend. home-assistant/frontend#5258

elupus · 2020-05-10T17:06:40Z

Ps. I just rebased frontend repo. Might have been a mistake. Will clean my frontend build and see if it behaves better. but it's behaving somewhat strange.

elupus · 2020-05-10T18:54:19Z

Had to rebuild my frontend build after rebasing it, then it got back to working. So it should be up-to date and working.

bdraco · 2020-05-10T21:06:35Z

Maybe present a button to trigger the login if the window is blocked?

bdraco · 2020-05-10T21:08:30Z

@elupus Once I got past the popup block, everything is working great 👍

It is the same list everywhere can could potentially be changed.

Avoids fixing tests

balloob · 2021-01-13T16:27:15Z

Going to close this. We should first address #32926 (comment) in a new PR before we can consider this.

elupus · 2021-01-13T16:37:15Z

There is a pull addressing just that open..

elupus · 2021-01-13T16:38:40Z

#44630

werdnum · 2021-02-02T02:56:39Z

#44630 has been merged. What else is needed to reopen consideration of this PR? I've been really hoping for something like this: being able to use industry standards instead of delegating to a hacky command-line tool.

reesericci · 2021-04-09T12:11:11Z

I just want to create an openid connect SSO solution with keycloak

michael-robbins · 2021-06-12T05:49:55Z

@balloob what else is left to reopen this PR and consider it again?

scrapid · 2021-08-01T23:44:23Z

@balloob When MS Windows machine is connected to AD domain but it temporarily does not have access to the domain controller via network, than every user currently logged to the system sill has access to it. Even after locking screen and unlocking it using meantime expired credentials. Should MS disable Windows AD integration, because in some cases Windows is not able to verify current privileges? It's ridiculous. I prefer conscious choice over limits and prohibition. Some people just need LDAP authentication even if it has own characteristics/disadvantages. Every Home Assistant admin should know what is he doing by enabling optional features, it's admin's responsibility. Let's allow HA admins to log off users automatically after some time to enforce users to use their credentials again and fetch current account status from remote databases. Or maybe let's allow HA admins to invalidate all the particular user's sessions on the admin's request. Those two options are standard in software with LDAP authentication. I think properly and very well designed current HA authentication with it's security and advantages (I appreciate this!) shouldn't limit other awaited options. Especially when docker HA installations need additional ldap tools so they cause another problems with custom script authentication method.

KayOhtie · 2021-08-02T01:27:51Z

@scrapid Your comparison to a Windows machine is a far cry from affecting a live application that impacts multiple things. Accurately following your comparison would still include rejecting access when it can't confirm, as authenticating with network applications is to do. A local computer and a system impacting multiple people is not a valid comparison.

That being said, I want to throw my support in here. There are a number of other applications such as Nextcloud, etc that do have options easily implemented for LDAP, SAML, or OpenID authentication. It seems as if the current hold up is more to do with how HA currently implements authentication than to do with whether or not it's actually feasible. That is an understandable hold up, and it's totally reasonable to say "HA's underlying architecture does not make safely implementing this as easy as many seem to think, but we may open up a branch for accepting contributions on it."

colemickens · 2021-08-02T01:47:16Z

So then, as someone asked exactly 6 months ago, now that the blocking issue was resolved, what remains in the way of merging this?

frenck · 2021-08-02T10:05:06Z

This is more a question for our forums. This PR is closed and handled for that matter.

Thanks for understanding.

homeassistant added the cla-signed label Mar 18, 2020

probot-home-assistant bot added the core label Mar 18, 2020

elupus mentioned this pull request Mar 18, 2020

Support external step in login flow home-assistant/frontend#5258

Closed

9 tasks

bdraco requested changes Mar 18, 2020

View reviewed changes

elupus commented Mar 19, 2020

View reviewed changes

homeassistant/auth/providers/openid.py Outdated Show resolved Hide resolved

elupus commented Mar 19, 2020

View reviewed changes

homeassistant/auth/providers/openid.py Outdated Show resolved Hide resolved

bramkragten reviewed Mar 21, 2020

View reviewed changes

homeassistant/helpers/config_entry_oauth2_flow.py Outdated Show resolved Hide resolved

stale bot added the stale label Apr 29, 2020

stale bot removed the stale label Apr 29, 2020

elupus force-pushed the openid branch from 2ce29d1 to e88b328 Compare May 2, 2020 17:24

elupus force-pushed the openid branch from 646677e to 5864f4d Compare May 10, 2020 16:31

elupus marked this pull request as ready for review May 10, 2020 18:54

elupus force-pushed the openid branch from 5864f4d to 797e591 Compare May 17, 2020 09:28

bdraco approved these changes May 17, 2020

View reviewed changes

elupus added 12 commits October 12, 2020 17:54

Adjust default title

b434ab7

Some more adjustments for casing for openid

284edf1

Log using subject instead of email

18090b6

Use preferred_username then given_name then name, then email

88d3274

Support subject whitelist

c335558

Add a test for non whitelisted user

a977c4b

Don't use a default list

60615f0

It is the same list everywhere can could potentially be changed.

Adjust stale doc string

bc70f60

Simplify name extraction from email

93401e3

Use standard OAuth helper

1c112d0

Adjust some orders to make tests pass

31924ee

Reduce changes to core oauth2 flow

44475e1

elupus force-pushed the openid branch from 4f368dc to 44475e1 Compare October 12, 2020 19:04

elupus added 3 commits October 12, 2020 22:35

Drop unneded change in cloud oauth2

470fae9

Adjust home connect test

1c65a22

Avoid changing state parameter for non login flow

bfa9abb

Avoids fixing tests

balloob mentioned this pull request Nov 17, 2020

LDAP/Active Directory authentication provider #37645

Closed

25 tasks

balloob closed this Jan 13, 2021

home-assistant locked as resolved and limited conversation to collaborators Aug 2, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support openid connect like authentication providers #32926

Support openid connect like authentication providers #32926

elupus commented Mar 18, 2020 •

edited

Loading

bdraco commented Mar 19, 2020

stale bot commented Apr 29, 2020

elupus commented Apr 29, 2020

elupus commented May 10, 2020

elupus commented May 10, 2020

bdraco commented May 10, 2020

elupus commented May 10, 2020

bdraco commented May 10, 2020

elupus commented May 10, 2020 •

edited

Loading

elupus commented May 10, 2020

elupus commented May 10, 2020

bdraco commented May 10, 2020

bdraco commented May 10, 2020

balloob commented Jan 13, 2021

elupus commented Jan 13, 2021

elupus commented Jan 13, 2021

werdnum commented Feb 2, 2021

reesericci commented Apr 9, 2021

michael-robbins commented Jun 12, 2021

scrapid commented Aug 1, 2021

KayOhtie commented Aug 2, 2021

colemickens commented Aug 2, 2021

frenck commented Aug 2, 2021

Support openid connect like authentication providers #32926

Support openid connect like authentication providers #32926

Conversation

elupus commented Mar 18, 2020 • edited Loading

Breaking change

Proposed change

Type of change

Example entry for configuration.yaml:

Additional information

Checklist

bdraco commented Mar 19, 2020

stale bot commented Apr 29, 2020

elupus commented Apr 29, 2020

elupus commented May 10, 2020

elupus commented May 10, 2020

bdraco commented May 10, 2020

elupus commented May 10, 2020

bdraco commented May 10, 2020

elupus commented May 10, 2020 • edited Loading

elupus commented May 10, 2020

elupus commented May 10, 2020

bdraco commented May 10, 2020

bdraco commented May 10, 2020

balloob commented Jan 13, 2021

elupus commented Jan 13, 2021

elupus commented Jan 13, 2021

werdnum commented Feb 2, 2021

reesericci commented Apr 9, 2021

michael-robbins commented Jun 12, 2021

scrapid commented Aug 1, 2021

KayOhtie commented Aug 2, 2021

colemickens commented Aug 2, 2021

frenck commented Aug 2, 2021

elupus commented Mar 18, 2020 •

edited

Loading

Example entry for `configuration.yaml`:

elupus commented May 10, 2020 •

edited

Loading