2fa with DUO.com

Feature Requests
1

I have been using DUO.com with a few projects now including Guacamole and VMware Horizon. The service works fast and always as expected. I enter my user name and password and get a push to my phone or smart watch. I can then accept or deny the login from my smart watch of phone with the push of either accept or deny button. I would love to see something like this for Hassio.

2

Iā€™m going to take a look at implementing this. If anyone else has started this or wants to please let me know.

2 Likes
3

Progress update:

Iā€™m new to developing for HA but Iā€™ve worked out I need to create an MFA component. Iā€™ve copied the insecure example as well as test editing the totp module.

Iā€™m currently stuck as I need to insert an iframe into the polymer-dialog. It looks like the front end may not allow this or Iā€™ve got to wrap the HTML code in the correct tags for the front end to understand itā€™s html. Currently itā€™s been displayed as .

Lots more to understand about how the frontend works and more source code to read before saying itā€™s not possible though.
1 Like
4

Are you still working on this @JumpMaster? Iā€™d like to use Duo as well and wouldnā€™t mind seeing if I can help. Not sure if you have a git repo up with the code currently or not

1 Like
5

Iā€™ve made a couple of PRs now and learned a lot more about this process. Iā€™ve also looked into how the MFA code works and it currently isnā€™t compatible with Duo. The MFA system takes a description (e.g. please enter your google auth code) and a field (e.g. a field for 6 numbers).

This isnā€™t compatible with Duo which would require an iFrame along with a few other fields. To implement this would require a lot of code changes to the front end and probably an issue raised within the architecture repo.

Iā€™ve had an issue open for 12 days which hasnā€™t had an update. This is holding up two PRs Iā€™ve raised but as they edit a base object it has to be agreed via the architecture repo.

I think the first step should be to raise the issue in architecture. At least find out if the team are interested in Duo support. If there not interested it wonā€™t get there time. Theyā€™re all extremely busy and know what they want to achieve. If weā€™re going to take their to look at something else it has to interest them.

Iā€™m happy to help and would like Duo support but Iā€™m not sure itā€™s the most important thing to add to HA at the current time.

Thereā€™s a pretty nice PR which seems stalled adding web auth as an MFA.

6

Thanks for getting back, Iā€™ll see if I can find the issue you raised and add my support. Seeing as how this project is for home automation and for it to be practical you need to expose your internal network externally, I think supporting more MFA platforms should be on the bucket list. I know theyā€™re busy so if thereā€™s anything we can do to get some more support around this and also help them achieve the goal once they roadmap the request, Iā€™m more than happy to dig in and learn/help any way that I can.

7

What might be more interesting / beneficial would be to have a 2fa system which uses the official mobile apps. So upon signing in you can either use Google Auth or confirm the prompt within the mobile app. In the same way Duo does.

This would require an addition to the mobile api and an app (for testing) and eventually to the mobile app.

But again does this add anything important to HA? It would be slightly more convenient to be able to click a prompt but opening Google Authenticator or Auth when logging in isnā€™t hard. I assume everyone selects ā€œRemember meā€ on their devices so logging in is not a frequent task.

8

Would love to see Duo for Home Assistant

9

I would love to see this too.

10

Push! Me too!