WTH!? No RBAC - Role Based Access Control? (Users & Groups rights)

Archive Month of "What the heck?!" (2020)
1

What The H?

I want to have my home assistant being used by all people living in the home. Having only an admin and a user is somewhat misleading…

I am the admin, my children and wife the users…

But then, WTH!? I don’t want to give my children acces to my bedroom tab!?

I would expect proper Role Based Access Control.

See below, more reason to prioritise this? :slight_smile:

:warning: No Longer an Active Project

I have come to the difficult decision to stop work on Custom Header and have archived the project. Please, see the farewell post for more info.

2

Remember HA is still in beta. You can always install a plugin that lets you do that with HACS.

3

You could use Custom header to restrict views per user.

2 Likes
4

You can create new lovelace dashboards and use them for RBAC. When creating a new dashboard you can mark it as Admin only.

For me I create a dashboard for users and then in a separate dashboard I have all my admin stuff

5

But what about the menu items?

1 Like
6
7

Completely agree that we need more Roles and maybe roles for views. Because as you are saying users is a bit generic.

You can set up a user to have their default dashboard something else but they can always select any dashboard that is available to users

8

Please note, in that post I’m not requesting access control, but merely the ability to show/hide (which is not the same).

2 Likes
9

Let’s keep custom things out of this and focus on the core :tada:

4 Likes
10
3 Likes
11

You could use Custom header to restrict views per user.

But setting this up for multiple dashboards with multiple views is not an easy task…

12

But that’s “custom”, and indeed a lot of “hassle”. Would like to see it “supported” in homeassistant

2 Likes
13

What happened to this? Nothing?

Or is it…?

1 Like
14

What happen(s/ed) to this very populair WTH?

1 Like
15

from the faq of the month of WTH

"Is everything reported going to be fixed/addressed?"

There is no guarantee that will happen. The goal is to lower the barrier to
reporting things for one month. Home Assistant still relies on contributors
to address or improve the project. However, we do think collecting feedback
this way can tremendously help with the upcoming

16

Me me me! Would love to see some role based permissions at least for the dashboard(s).

17

I was just looking to setup access for my kid to control her room, when I learned there’s no access control. I’m astonished by this security hole missing basic feature.

18

Design decision/focus of effort != security hole. :slight_smile:

I bet PRs would be accepted to enhance the RBAC though - it’s something a bunch of us would like and benefit from, but either don’t have the skills or time to make the enhancements and thus are grateful for the features and fixes others are adding!

19

Remember, you can always lock down the dashboard pages for a single user:
image

1 Like
20

This doesn’t turn off the GPS MAP, the log entries nor the history graphs. None of which a standard user should have access to.