Enable auth by default 🙈

[balloob]

Description:

This enabled the new authentication system by default. This will enable both the Home Assistant local auth provider and the Legacy API password auth provider. New users will be routed via an onboarding flow on initial boot to create a new user. This new user will be owner and is able to add more users.

Breaking change: It is no longer possible to use Home Assistant without authentication. To allow users to log in without entering a username or password, you can configure the trusted networks auth provider. If you were using another application to provide authentication, like NGINX, configure it to set the header x-ha-access: <API PASSWORD> on each request. In the future, this header will be replaced with a header containing a long lived access token (#15195).

(I don't use these platforms like NGINX, would be nice if people would contribute config examples)

Related issue (if applicable): #15703

Checklist:

• The code change is tested and works locally.
• Local tests pass with tox. Your PR cannot be merged unless tests pass

If the code does not interact with devices:

• Tests have been added to verify that the new code works.

[awarecan]

To allow users to log in with entering a username or password, you can use the trusted networks auth provider.

Sounds not right.

To allow users to log in without entering password, you can use the trusted networks auth provider.

Example configuration for trusted networks auth provider:

homeassistant:
  auth_providers:
    - type: homeassistant
    - type: legacy_api_password
    - type: trusted_networks

http:
  trusted_networks:
    - 127.0.0.1
    - ::1
    - 192.168.0.0/24

[balloob]

My bad, that didn't sound right. I am going to add some docs . Will add the config example there.

[awarecan]

Another thought, if user doesn't set api_password, we should either not load leagcy_api_password auth provider, or let it failed quietly.

[balloob]

@awarecan good point, I will open a PR.

[pvizeli]

or let it failed quietly

Not load with a error is better. Fails is a bit hard for docker user.

[balloob]

I have a better idea, cooking up a PR :)

[balloob]

Legacy API password provider will now abort any login flow if API password has not been set: #16127

[awarecan]

So the new user will see two auth providers, and the legacy one is broken out-of-box?

[balloob]

They will see an abort message saying that it won't work because there is no HTTP password. They already created an owner via onboarding, so they can log in with that.

[pvizeli]

Why we need legacy_api_password in default config? If they not working out of the box we need it not inside default config because user need change config manual and if they need change the config, they could also set the legacy_api_password?

[awarecan]

I think we should auto load legacy_api_pasword depends on if http.api_password exist

[balloob]

I like that idea.

[balloob]

Updated.

[balloob]

If a user has just http: in their config, the key exists but is None. The or solves both if key does not exist or when it's None.

[balloob]

Pascal you were right, we should avoid to get people to configure auth themselves. The default settings should suffice. This is a good solution.