Feature Request: Privilege revocation/granting through IdP #187
Replies: 2 comments
-
|
This was considered before, but HA doesn't like it if you change permissions on login. It only gives you an option to do so (in the public API's) whenever you are creating a user. Because for role invalid, no user is created, upgrading works as intended as the full code is ran in the next iteration as well. Theoretically you are right and I could implement checking the permissions on every callback, but I am not quite sure if we should do that. OIDC integration using a custom integration is always going to be limited. I can hack in more features by playing with HA, but that makes it more likely that the integration will break in the future. Currently, you also aren't automatically logged out, so this integration effectively provides a very consistent 'onboard-only' home-use experience. It's not usable in a business setting in any way and I don't promote that. I feel that implementing this feature to check upon login by using internal HA API's (instead of the more public auth provider methods I am using now) already crosses the 'no-messing' boundary while not providing a reliable business experience anyway because of the missing logout and lifecycle features. What's your opinion on this? |
Beta Was this translation helpful? Give feedback.
-
|
I see you point about the fragility of an implementation of this feature. And the lack of "Single Sign-Out" would have been the next thing I'd have mentioned, as I would ideally like to see this, too. I'm not that familiar with HA auth, so I had to dig a bit. So take this with a grain of salt, but these would by my suggestions: Granting/Revoking Admin RightsUpdating a user seems to be possible via This would be my main feature request, I would love to see this! Granting/Revoking Access RightsGranting works, as you rightly point out. HA Session Invalidation / Single Sign-OutThis one's a bit tricky, I think that's just how it is. But it is also less essential than updating roles/groups, imo. One fairly straightforward way to make this work anyhow would be to implement OIDC back-channel logout. Another option would be to globally deactivate the user (e.g. through
HA is not usable in a mixed-trust, let alone business setting anyway, as it provides nothing in the way of functional ACLs/permissions as it stands currently... Tbh I'm bummed out that HA is dragging their feet on something this essential since 2019 :/ |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Thank you for creating this integration, and also for your advocacy for upstream adoption!
I'm successfully running v0.7.0-alpha-rc3. It works great, including the frontend injection for the login page. I do have one feature request, though:
User roles are set in accordance to group membership on initial user creation. Changing group memberships after the fact does not update home assistant roles for the user:
system-userscannot be grantedsystem-adminprivilegessystem-adminprivileges cannot be revoked, downgrading the user tosystem-usersroleinvalidroleRoles seem to be set once, at initial credential creation, by an external call from home assistant to
async_user_meta_for_credentials.I feel like roles should be updated again somewhere around here, line 58:
hass-oidc-auth/custom_components/auth_oidc/endpoints/callback.py
Lines 46 to 70 in 04a693c
That is, after fetching
user_details, but just before potentially rejecting access for users whererole==invalid.Alternatively, it could be updated (saved to database) in
async_save_user_info, with a separate error code being raised in case privileges were just revoked.Upgrading users from
invalid(i.e. access prohibited) to eithersystem-usersorsystem-adminalready works as it is.I know the other grants/revocations can be done manually through the home assistant UI, but I would prefer to be able to manage this through my IdP.
Keep up the good work! :)
Beta Was this translation helpful? Give feedback.
All reactions