Just upgraded to .77 from .73. It asked me to create a new account which I tried to do but it says “Error: Something went wrong.” It flips between Legacy API Password and Home Assistant Local but does nothing else. Tried going direct so no proxy but get the same thing. Going back to .73 for now as I can no longer log in.
2 Likes
You may want to update to 0.76 again, the authentication enforcement was enabled by .77
What is the general roadmap for authentication going forward? Will this eventually add authorization as well - set some users as just accessing the overview area vs other users seeing the configuarion/hass.io sections as well?
I assume that they will but just curious about the priority of authorization/privs in the interface.
Use this query to check our backlog for auth, that is not a roadmap, just the tasks we will do in next or two release
Features like fine-grained access control etc definitively on the roadmap, just has not been written down.
1 Like
Thank you!
Can you do that while still moving to 0.77? Or are you holding back on an earlier release?
Yes you can. As long as you’ve still got it defined (and you haven’t defined any auth_providers:) it’ll be automatically enabled and supported.
1 Like
@DamianFlynn, I’ve been searching for folks that use Traefik. Do you try to use trusted-networks/trusted-proxies to avoid password auth on your internal networks? I’m trying to set this up for lovelace UI on my tablets, but I’m failing because of websocket auth issues due to Traefik. The UI auth is successful, but then there is some web socket call that gets sent where the auth fails because Traefik isn’t setting the headers correctly for trusted-networks/trusted-proxies for web socket. Were you able to get around this with Traefik or were you not using trusted-networks?
Also, if you wouldn’t mind, can you send your Traefik HA config so I can compare with mine?
Thanks!!
Hello I have just upgraded from 0.75.3 to 0.77.3.
New authentication is working with internal ip adresses 192.xxx, but not with external ip address which is routed to pi/homeassistant. Switching back to 0.75.3 is working correctly
with external ip address.
With 0.77.3 and external address , the credential fields do not appear and the error message is invalid client id ( see image)
best regards
Please PM me your full URL showed in browser, do not masked them, every character matters
Thanks, here the url, XX.XXX.X.XX is my external IP, forwarded currently on 0.75.3
if necessary i can reinstall 0.77.3
I don’t think we allowed external IP access per the IndieAuth spec, maybe we should put it in document. If you want to access from external network, you have to use FQDN.
Either you have a domain name or you make a local DNS entry by modify hosts file
TL;DR;
We implemented slightly different than IndieAuth, we allow following hostname as client_id
# MUST be domain names or a loopback interface and
# MUST NOT be IPv4 or IPv6 addresses except for IPv4 127.0.0.1
# or IPv6 [::1] or any internal network IP
# IP addresses of loopback interfaces
ALLOWED_IPS = (
ip_address('127.0.0.1'),
ip_address('::1'),
)
# RFC1918 - Address allocation for Private Internets
ALLOWED_NETWORKS = (
ip_network('10.0.0.0/8'),
ip_network('172.16.0.0/12'),
ip_network('192.168.0.0/16'),
)
Thanks, I have no FQDN so i have to access my external IP adress.
I was just trying to access as before (0.75.3), not with Auth but with
- type: legacy_api_password
but it seems HA wants now always Auth ?
Suprisingly it works correctly with lan addresses ?
It was designed in purpose. You can add a fake domain in your computer where hosts your browser by modify hosts file. If you are on Windows, open windows/system32/drivers/etc/hosts with administrator privilege, add an entry likes
XX.XX.XX.XX hassbian.myhome.net
Then you can use this domain name to access your HA instance
Hey Chris
I don’t use trusted networks at all as I work as a cloud architect and one of our guiding principles is that the network is not trusted, and only people are responsible, so for now it’s user identification
I plan to leverage an oauth provider such as Azure AD for both traefik and Home assistant but not had time to evaluate the implementation in practice yet, just theory and research currently
I’ll drop you my traefik config in the morning when I’m behind the computer
1 Like
what is the purpose of the new authentication schema? what was lacking in the old system that the new system has set out to fix?
why is this enabled by default? and how does one disable it?
is there a performance impact to supporting multiple users and sessions like this? personally, my hass.io instance is regularly stressed and adding multiple users to it certainly isn’t going to help that.
I don’t see any reason for having multiple users, could we at the very least have a way to default to a ‘default user’ when launching the front end or performing other actions if nothing else?
2 Likes
I second this. Please make trusted network authenticator support a default user, so we can get rid of any login mask.
2 Likes
I also had the same problem. Check if there is new cube entity_id.
On my system hass added _2 on old entity
binary_sensor.cube_xxxxxxxxxxxxxxx_2
Thank you! Already fixed it. It was a bit unexpected for me.