Added command_line auth provider that validates credentials by calling a command #19985

bob1de · 2019-01-11T20:39:30Z

Description:

A new authentication provider that checks username/password by calling an external program, passing the values as environment variables. If the program exits with exit code 0, authentication succeeds.

Additionally, the program can print out lines of the form

KEY=VALUE

to give HA some information about the authenticating user. Currently, only name is supported, but groups are thinkable as well when there will be an official API for interfacing with HA's group system in the future.

As an example, I wrote a script to do authentication against LDAP, that I'll link here soon.

Related issue (if applicable): Closes #19975

Pull request in home-assistant-polymer: home-assistant/frontend#2561

Pull request in home-assistant.io with documentation (if applicable): home-assistant/home-assistant.io#8321

Example entry for `configuration.yaml` (if applicable):

homeassistant:
  auth_providers:
  - type: command_line
    command: /config/auth.sh
    # Optionally, a list of arguments.
    #args: []
    # Optionally, accept meta variables.
    #meta: true

Checklist:

The code change is tested and works locally.
Local tests pass with tox. Your PR cannot be merged unless tests pass
There is no commented out code in this PR.

If user exposed functionality or configuration variables are added/changed:

Documentation added/updated in home-assistant.io

If the code does not interact with devices:

Tests have been added to verify that the new code works.

Closes home-assistant#19975

homeassistant/auth/providers/external.py

awarecan

Please add unit test.

You can include a script to mock external program in your unit test to return valid or invalid result

homeassistant/auth/providers/command_line.py

bob1de · 2019-01-12T01:16:29Z

I'll create an unit test when the API is final.

balloob · 2019-01-12T01:30:16Z

This looks good. Will need some tests written.

balloob · 2019-01-12T01:43:51Z

I suggest that for MVP we remove the metadata and just look at the return code. Keep it simple.

bob1de · 2019-01-12T09:15:35Z

Ah I see, MVP... Removing the metadata sounds not desirable to me. I don't want to see "You're logged in as ." in the UI because HA doesn't know my name. Could become more problematic when HA maybe logs user actions some day.

Having to turn it on explicitly sounds more appropriate to me.

homeassistant/auth/providers/command_line.py

bob1de · 2019-01-12T12:50:30Z

And here's a working example for authentication against LDAP:

https://github.com/efficiosoft/ldap-auth-sh

homeassistant/auth/providers/command_line.py

frenck · 2019-01-14T21:00:43Z

Could not find a matching documentation PR on our documentation repository, adding docs-missing label.

awarecan

There are two stuffs are missing besides the documentation pointed by Frenck

unit test for login flow
a front-end PR to include string resources, you can use leagcy_api_password auth provider as example: https://github.com/home-assistant/home-assistant-polymer/blob/f98fff9ffdd101b029f44e8ffe5a59545d388e84/src/translations/en.json#L939

homeassistant/auth/providers/command_line.py

bob1de · 2019-01-14T23:12:34Z

@frenck and @awarecan

I won't create any docs until we mutually agreed on the API, won't do it twice when it needs to be changed. Are you happy with meta being optional and False by default?

I'll look into testing the login flow as well... Just took the existing tests from insecure_example, which didn't include the login flow.

Strings for the frontend... alright.

awarecan · 2019-01-14T23:15:20Z

I am fine with meta being optional and False by default

awarecan · 2019-01-14T23:18:22Z

Here is the example of login flow test, https://github.com/home-assistant/home-assistant/blob/201fd4afeec56f031dab027f0b84debea5bced77/tests/auth/providers/test_homeassistant.py#L67

Regards home-assistant/core#19985

klaasnicolaas · 2019-01-27T20:37:26Z

home-assistant/home-assistant.io#8321

bob1de · 2019-01-29T11:09:41Z

I think this PR is ready for final review and merge now.

homeassistant/auth/providers/command_line.py

balloob

It looks good 🎉 Just one question about the username stripping. Probably easiest to implement the username stripping in the config flow btw.

bob1de · 2019-01-29T19:37:32Z

@balloob Hmm, I'm not sure I understand correctly. Usernames aren't stripped by this auth provider, as with any other existing provider I think.

bob1de · 2019-01-29T19:44:51Z

The only things that are stripped are the meta variables(currently only the user's real name).

awarecan · 2019-01-29T21:38:09Z

Balloob is referencing a recent merged PR, #20150

balloob · 2019-01-30T03:41:14Z

If a user enters "hello ", and the next time it enters "hello", the command line will probably see it as the same (or not?), the credentials are matched on user input, not on what script understood of it being.

bob1de · 2019-01-30T08:39:40Z

No, it won't. Environment variables preserve all characters. However, it depends on the script the user configures to run to not strip them itself. I can add a note about that to the docs.

bob1de · 2019-01-30T08:46:59Z

Did it.

bob1de · 2019-01-30T14:55:41Z

On the other hand, I see nothing that stands against stripping usernames from the beginning on. So do you think it should simply be done before it get's released to prevent having a breaking change later?

bob1de · 2019-02-04T09:02:18Z

@balloob Considering the modernized homeassistant auth provider from #20150, I'd probably start stripping usernames with the command_line auth provider from the beginning. Will change it in code & docs.

balloob · 2019-02-07T00:36:35Z

Niiiiiice 🎉

* Added strings for command line auth provider Regards home-assistant/core#19985 * Reuse existing translation keys for new command_line auth provider

* Added docs for command line auth provider Regards home-assistant/core#19985 * Added reference to a compatible script for LDAP authentication * Added note about stderr with command_line auth provider * Added note about stripping usernames * Note that usernames are stripped with command_line auth provider

@awarecan

…g a command (home-assistant#19985) * Added external auth provider that calls a configurable program Closes home-assistant#19975 * Raise proper InvalidAuth exception on OSError during program execution * Changed name of external auth provider to command_line * Renamed program config option to command in command_line auth provider * Made meta variable parsing in command_line auth provider optional * Added tests for command_line auth provider * Fixed indentation * Suppressed wrong pylint warning * Fixed linting * Added test for command line auth provider login flow * Log error when user fails authentication * Use %r formatter instead of explicit repr() * Mix all used names of typing module into module namespace I consider this nasty and bad coding style, but was requested by @awarecan for consistency with the remaining codebase. * Small code style change * Strip usernames with command_line auth provider

Added external auth provider that calls a configurable program

af49ba5

Closes home-assistant#19975

homeassistant added the cla-signed label Jan 11, 2019

ghost added the in progress label Jan 11, 2019

houndci-bot reviewed Jan 11, 2019

View reviewed changes

homeassistant/auth/providers/external.py Outdated Show resolved Hide resolved

Raise proper InvalidAuth exception on OSError during program execution

ba05606

bob1de force-pushed the external-auth-provider branch from 7b6ca8c to ba05606 Compare January 11, 2019 21:51

balloob reviewed Jan 12, 2019

View reviewed changes

homeassistant/auth/providers/external.py Outdated Show resolved Hide resolved

Changed name of external auth provider to command_line

38f9361

awarecan requested changes Jan 12, 2019

View reviewed changes

homeassistant/auth/providers/command_line.py Outdated Show resolved Hide resolved

Renamed program config option to command in command_line auth provider

c3b1477

bob1de changed the title ~~Added external auth provider that validates credentials by calling an external program~~ Added command_line auth provider that validates credentials by calling a command Jan 12, 2019

houndci-bot reviewed Jan 12, 2019

View reviewed changes

homeassistant/auth/providers/command_line.py Outdated Show resolved Hide resolved

Made meta variable parsing in command_line auth provider optional

5d100af

bob1de force-pushed the external-auth-provider branch from 4f368bf to 5d100af Compare January 12, 2019 10:43

Robert Schindler added 2 commits January 12, 2019 11:47

Added tests for command_line auth provider

06c1355

Fixed indentation

9c67785

Suppressed wrong pylint warning

a1c7a8d

houndci-bot reviewed Jan 12, 2019

View reviewed changes

homeassistant/auth/providers/command_line.py Outdated Show resolved Hide resolved

Fixed linting

c6c64aa

frenck added the docs-missing label Jan 14, 2019

awarecan requested changes Jan 14, 2019

View reviewed changes

bob1de pushed a commit to bob1de/home-assistant.io that referenced this pull request Jan 27, 2019

Added docs for command line auth provider

54a368d

Regards home-assistant/core#19985

bob1de mentioned this pull request Jan 27, 2019

Added docs for command line auth provider home-assistant/home-assistant.io#8321

Merged

2 tasks

Small code style change

bc36d17

frenck removed the docs-missing label Jan 28, 2019

This was referenced Jan 28, 2019

Enable auth providers to update user information upon authentication #20547

Closed

Enable auth providers to update user info upon authentication #20550

Closed

balloob reviewed Jan 29, 2019

View reviewed changes

homeassistant/auth/providers/command_line.py Show resolved Hide resolved

balloob reviewed Jan 29, 2019

View reviewed changes

homeassistant/auth/providers/command_line.py Show resolved Hide resolved

balloob approved these changes Jan 29, 2019

View reviewed changes

Strip usernames with command_line auth provider

f157848

balloob approved these changes Feb 7, 2019

View reviewed changes

balloob merged commit 06f3e81 into home-assistant:dev Feb 7, 2019

ghost removed the in progress label Feb 7, 2019

bob1de deleted the external-auth-provider branch February 7, 2019 21:14

balloob mentioned this pull request Feb 20, 2019

0.88.0 #21238

Merged

tomhoover mentioned this pull request Mar 26, 2019

Command Line Authorisation Provider (0.88) tomhoover/home-assistant_config#33

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added command_line auth provider that validates credentials by calling a command #19985

Added command_line auth provider that validates credentials by calling a command #19985

bob1de commented Jan 11, 2019 •

edited

awarecan left a comment •

edited

bob1de commented Jan 12, 2019

balloob commented Jan 12, 2019

balloob commented Jan 12, 2019

bob1de commented Jan 12, 2019

bob1de commented Jan 12, 2019

frenck commented Jan 14, 2019

awarecan left a comment

bob1de commented Jan 14, 2019

awarecan commented Jan 14, 2019

awarecan commented Jan 14, 2019

klaasnicolaas commented Jan 27, 2019

bob1de commented Jan 29, 2019

balloob left a comment

bob1de commented Jan 29, 2019

bob1de commented Jan 29, 2019

awarecan commented Jan 29, 2019

balloob commented Jan 30, 2019

bob1de commented Jan 30, 2019

bob1de commented Jan 30, 2019

bob1de commented Jan 30, 2019

bob1de commented Feb 4, 2019

balloob commented Feb 7, 2019

Added command_line auth provider that validates credentials by calling a command #19985

Added command_line auth provider that validates credentials by calling a command #19985

Conversation

bob1de commented Jan 11, 2019 • edited

Description:

Example entry for configuration.yaml (if applicable):

Checklist:

awarecan left a comment • edited

Choose a reason for hiding this comment

bob1de commented Jan 12, 2019

balloob commented Jan 12, 2019

balloob commented Jan 12, 2019

bob1de commented Jan 12, 2019

bob1de commented Jan 12, 2019

frenck commented Jan 14, 2019

awarecan left a comment

Choose a reason for hiding this comment

bob1de commented Jan 14, 2019

awarecan commented Jan 14, 2019

awarecan commented Jan 14, 2019

klaasnicolaas commented Jan 27, 2019

bob1de commented Jan 29, 2019

balloob left a comment

Choose a reason for hiding this comment

bob1de commented Jan 29, 2019

bob1de commented Jan 29, 2019

awarecan commented Jan 29, 2019

balloob commented Jan 30, 2019

bob1de commented Jan 30, 2019

bob1de commented Jan 30, 2019

bob1de commented Jan 30, 2019

bob1de commented Feb 4, 2019

balloob commented Feb 7, 2019

bob1de commented Jan 11, 2019 •

edited

Example entry for `configuration.yaml` (if applicable):

awarecan left a comment •

edited