Access Control: real per-user permissions, as a custom integration

I stayed in a hotel a while ago where every room had a touch screen running Home Assistant (this one). Nice setup, until I realised I could control every other room from mine. Lights, blinds, aircon, and the common areas too.

That’s not really their fault. Home Assistant doesn’t give you a way to do it properly. You’re either an admin or you’re not, and that’s the whole permission system. A non-admin still sees every camera, every lock, every sensor. Same reason I couldn’t give a guest a dashboard with just the lights on it, or give my kid a tablet that can’t open the front door.

So I built this: GitHub - FezVrasta/ha-rbac: Role-based access control for Home Assistant. Guests see the lights, kids get their own dashboard, nobody sees where your phone is. · GitHub

You make roles and hand them out. Per role you pick:

  • which entities they can see and control, by area, domain, label, floor, or one specific thing
  • which attributes to hide, like latitude on people, the code a lock exposes, IP addresses, serial numbers
  • which dashboards, add-ons and screens show up in their sidebar
  • whether they can get at settings at all

Hidden actually means hidden. The entity isn’t greyed out, it’s just not there: not on the dashboard, not in search, not in history, not in the API. And there’s a log of everything it refused, so when someone says “it stopped working” you can see what and why.

It’s all in a normal panel. No YAML.

It works by sitting in front of the API and filtering, so it doesn’t patch anything or touch your config. The bit I like is that it doesn’t ship a list of what’s dangerous. Home Assistant already marks its own admin commands and this reads those markings live on your instance, so it doesn’t go stale every release.

Two things before you try it. Home Assistant has to stop answering directly, so you set the server host to 127.0.0.1 under Settings > System > Network and let this answer on 8123 instead. Skip that and it does nothing, because anyone can just go round it with the token they already have. And it won’t save you from someone with a shell on the machine, or from an add-on that has API access.

It’s an alpha. It’s tested and I’ve spent a while trying to break it, including on a real Supervised box with add-ons installed, but it hasn’t lived in anyone else’s house yet. Don’t make it the only thing between someone and your front door.

If you do try it, the report I actually want is “my dashboard broke, here’s what the Denials tab said”.

HACS, as a custom repository.

2 Likes

This should be as default in HA… Great
!

More security by osculation…
I applaud the effort but I’m not convinced.

Perhaps look into contributing to the existing RBAC efforts instead of striking out on your own? Although I admit I know the effort is ongoing as I have seen postings for N-C jobs to that effect but don’t know where one would contribute to that. I don’t see it in the Discord Projects catagory, for example.

Either way I hope this works out and thanks again for the effort.

Security by obscurity? No this is not the case, this is a proper role based access system, data is literally never sent to the client, and requests are blocked when not allowed.

Existing RBAC systems either patch the core HA components, or implement a completely separate control surface. I wanted something that sits on top of HA without breaking on each release and allows to use every HA feature like the stock experience allows.

2 Likes

This sounds great and I’m willing to look into it…
But I wonder, how is this going to work with a proxy forwarder (NGinx) ?

It doesn’t make any difference, everything will work as intended.

2 Likes

Finally came around to test this, so far so good, but…

Person Request Why Entities
TestUsr GET /local/tmp/snapshot_camera__1788254723.jpg Not allowed to use that commandrole does not permit admin-tier request ‘GET /local/tmp/snapshot_camera__1788254723.jpg’

How to allow this ??

Please open an issue on GitHub so I can keep track of this.

1 Like