Allows the supervisor to send a session's user to addon with header X-Remote-User #88472

baflo · 2023-02-20T06:58:16Z

Related PRs

#88472
home-assistant/frontend#15505
home-assistant/supervisor#4152

Proposed change

This implements a feature that allows the supervisor to send a session's username to an addon. The hassio component will add the username in the body if the command is /ingress/session.

Type of change

Dependency upgrade
Bugfix (non-breaking change which fixes an issue)
New integration (thank you!)
New feature (which adds functionality to an existing integration)
Deprecation (breaking change to happen in the future)
Breaking change (fix/feature causing existing functionality to break)
Code quality improvements to existing code or addition of tests

Additional information

This PR fixes or closes issue: fixes #
This PR is related to issue:
Link to documentation pull request:

Checklist

The code change is tested and works locally.
Local tests pass. Your PR cannot be merged unless tests pass
There is no commented out code in this PR.
I have followed the development checklist
The code has been formatted using Black (black --fast homeassistant tests)
Tests have been added to verify that the new code works.

If user exposed functionality or configuration variables are added/changed:

Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

The manifest file has all fields filled out correctly.
Updated and included derived files by running: python3 -m script.hassfest.
New or updated dependencies have been added to requirements_all.txt.
Updated by running python3 -m script.gen_requirements_all.
For the updated dependencies - a link to the changelog, or at minimum a diff between library versions is added to the PR description.
Untested files have been added to .coveragerc.

To help with the load of incoming pull requests:

I have reviewed two other open pull requests in this repository.

home-assistant · 2023-02-20T06:58:23Z

Hey there @home-assistant/supervisor, mind taking a look at this pull request as it has been labeled with an integration (hassio) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of hassio can trigger bot actions by commenting:

@home-assistant close Closes the issue.
@home-assistant rename Awesome new title Change the title of the issue.
@home-assistant reopen Reopen the issue.
@home-assistant unassign hassio Removes the current integration label and assignees on the issue, add the integration domain after the command.

balloob · 2023-02-20T21:29:33Z

Can you explain how you plan on this being used?

baflo · 2023-02-21T05:16:55Z

Can you explain how you plan on this being used?

As the documentation for addon development already promises, addons get authentication "for free" by the home assistant ingress.

However, the addons currently don't know what user is authenticated. With this feature Home Assistant works like a SSO service and allows addons to maintain different users.

This could e.g. be used by RaspberryMatic for different users with different permissions or by paperless-ngx to manage documents for select users.

This was also requested by multiple threads in the forum:
https://community.home-assistant.io/t/hassio-ingress-header-for-user-name-exist/202291
https://community.home-assistant.io/t/expose-the-active-home-assistant-user-to-the-addon-through-ingress/221144

pvizeli

I think that make sense for SSO. I had the same idea but not time for it

homeassistant/components/hassio/websocket_api.py

balloob · 2023-02-22T14:12:27Z

The name of the user is not static, and can be changed by the user. I think that we should also include the user ID and recommend that to be used as the identifier for the user.

baflo · 2023-02-24T09:35:20Z

The name of the user is not static, and can be changed by the user. I think that we should also include the user ID and recommend that to be used as the identifier for the user.

I find a user ID and two usernames on the user object. I understand I shouldn't use the displayed username, as that one is obviously not static.

Is the "login" username also considered non-static? I would prefer to use that to send to addons. However, if only the actual ID is static, I'll change it to send that.

EDIT: nvm, just understood the login-username is just one of many possibble auth-possibilities. So it must be the ID.

pvizeli

Needs Supervisor PR merged as well

pvizeli

NVM, we use _ for API data

pvizeli · 2023-03-01T09:37:54Z

homeassistant/components/hassio/const.py

@@ -9,6 +9,7 @@
 ATTR_COMPRESSED = "compressed"
 ATTR_CONFIG = "config"
 ATTR_DATA = "data"
+ATTR_SESSION_DATA_USER_ID = "user-id"


Suggested change

ATTR_SESSION_DATA_USER_ID = "user-id"

ATTR_SESSION_DATA_USER_ID = "user_id"

home-assistant · 2023-03-01T09:38:10Z

Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍

Learn more about our pull request process.

balloob · 2023-03-01T13:51:39Z

I'm actually wondering now, why don't we just add the hass user ID + is-admin header to every ingress request we forward? that way we don't need a new API.

pvizeli · 2023-03-01T13:56:36Z

I'm actually wondering now, why don't we just add the hass user ID + is-admin header to every ingress request we forward? that way we don't need a new API.

It's about the session, giving the possibility to explicitly give access to add-ons at the user base. We should touch the header of forwarding stuff less as possible. For the API itself, yeah we can forward such information and also protocol what or who is using it. But now you mix 2 things together. The API is body driven for features and access are header driven.

balloob · 2023-03-01T14:28:04Z

Had a quick call with Pascal. He is right, we should have this information stored in the session itself, as it unlocks other features like user-based access control for ingress. It also should be set here, and not in the frontend as we do not want to allow for impersonation.

github-actions · 2023-08-15T17:05:12Z

There hasn't been any activity on this pull request recently. This pull request has been automatically marked as stale because of that and will be closed if no further activity occurs within 7 days.
Thank you for your contributions.

baflo · 2023-08-16T05:04:55Z

Not stale :)

Working draft for x-remote-user

46d9e14

home-assistant bot added cla-signed core integration: hassio new-feature small-pr PRs with less than 30 lines. Quality Scale: internal labels Feb 20, 2023

baflo changed the title ~~Working draft for x-remote-user~~ Allows the supervisor to send a session's user to addon with header X-Remote-User Feb 20, 2023

baflo added 2 commits February 21, 2023 08:40

Adds comment

45248bd

Merge branch 'home-assistant:dev' into remote-user

5c3f311

pvizeli reviewed Feb 22, 2023

View reviewed changes

homeassistant/components/hassio/websocket_api.py Show resolved Hide resolved

baflo added 4 commits February 24, 2023 10:04

Submits user id instead of its name

970aef2

Move lines out of try-catch block

dc17fca

Merge branch 'dev' into remote-user

6d17781

Merge branch 'dev' into remote-user

e6e23f2

pvizeli approved these changes Mar 1, 2023

View reviewed changes

pvizeli requested changes Mar 1, 2023

View reviewed changes

home-assistant bot marked this pull request as draft March 1, 2023 09:38

baflo added 7 commits March 3, 2023 07:26

Merge branch 'dev' into remote-user

251f842

Merge branch 'dev' into remote-user

ea72bcd

Updates payload attribute

e04833e

Merge branch 'dev' into remote-user

4e4557a

Merge branch 'dev' into remote-user

b40954d

Removes unnecessary user data from user info API

b4bb0b0

Merge branch 'dev' into remote-user

2f7bcd7

baflo marked this pull request as ready for review May 17, 2023 12:53

baflo requested a review from a team as a code owner May 17, 2023 12:53

home-assistant bot requested a review from pvizeli May 17, 2023 12:53

baflo added 2 commits May 17, 2023 16:37

revert changes

e2aade2

Merge remote-tracking branch 'origin/remote-user' into remote-user

8bb5ae6

github-actions bot added the stale label Aug 15, 2023

github-actions bot removed the stale label Aug 16, 2023

pvizeli approved these changes Aug 22, 2023

View reviewed changes

pvizeli merged commit 00b75ce into home-assistant:dev Aug 22, 2023
3 checks passed

github-actions bot locked and limited conversation to collaborators Aug 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allows the supervisor to send a session's user to addon with header X-Remote-User #88472

Allows the supervisor to send a session's user to addon with header X-Remote-User #88472

baflo commented Feb 20, 2023 •

edited

home-assistant bot commented Feb 20, 2023

balloob commented Feb 20, 2023

baflo commented Feb 21, 2023 •

edited

pvizeli left a comment

balloob commented Feb 22, 2023

baflo commented Feb 24, 2023 •

edited

pvizeli left a comment

pvizeli left a comment

pvizeli Mar 1, 2023

home-assistant bot commented Mar 1, 2023

balloob commented Mar 1, 2023

pvizeli commented Mar 1, 2023

balloob commented Mar 1, 2023

github-actions bot commented Aug 15, 2023

baflo commented Aug 16, 2023

	ATTR_SESSION_DATA_USER_ID = "user-id"
	ATTR_SESSION_DATA_USER_ID = "user_id"

Allows the supervisor to send a session's user to addon with header X-Remote-User #88472

Allows the supervisor to send a session's user to addon with header X-Remote-User #88472

Conversation

baflo commented Feb 20, 2023 • edited

Related PRs

Proposed change

Type of change

Additional information

Checklist

home-assistant bot commented Feb 20, 2023

balloob commented Feb 20, 2023

baflo commented Feb 21, 2023 • edited

pvizeli left a comment

Choose a reason for hiding this comment

balloob commented Feb 22, 2023

baflo commented Feb 24, 2023 • edited

pvizeli left a comment

Choose a reason for hiding this comment

pvizeli left a comment

Choose a reason for hiding this comment

pvizeli Mar 1, 2023

Choose a reason for hiding this comment

home-assistant bot commented Mar 1, 2023

balloob commented Mar 1, 2023

pvizeli commented Mar 1, 2023

balloob commented Mar 1, 2023

github-actions bot commented Aug 15, 2023

baflo commented Aug 16, 2023

baflo commented Feb 20, 2023 •

edited

baflo commented Feb 21, 2023 •

edited

baflo commented Feb 24, 2023 •

edited