This custom component allows you to delegate authentication to a reverse proxy.
This integrations checks the value of a configured header and authenticates based on its value. The value of the header is checked against usernames AND full names. Users have to be created in Home Assistant by hand.
Use with caution. If misconfigured, this can lead to a Home Assistant instance that anyone can access
Add this repository to HACS.
Update your configuration.yaml file with
http:
use_x_forwarded_for: true
trusted_proxies:
- 1.2.3.4/32 # This needs to be set to the IP of your reverse proxy
auth_header:
# Optionally set this if you're not using authentik proxy or oauth2_proxy
# username_header: X-Forwarded-Preferred-Username
# Optionally enable debug mode to see the headers Home-Assistant gets
# debug: false
# Optionally, if something is not working right, add this block below to get more information
logger:
default: info
logs:
custom_components.auth_header: debug
Use with Cloudflare access
Note: This uses the email address provided by cloudflare, therefore you need to rename your users to use the email provided by the identity provider of your Cloudflare Access Account
- Set up a remotely managed cloudflare tunnel (Example)
- Set up a Cloudflare Access Application for your Domain
- Obtain your AUD tag
http:
use_x_forwarded_for: true
trusted_proxies:
- 1.2.3.4/32 # This needs to be set to the IP of your reverse proxy
auth_header:
use_cf_access: true
cf_team: <your Cloudflare Zero Trust team name>
cf_aud: <see step 3>
Afterwards, restart Home Assistant.
See goauthentik/authentik#884 (comment)
On boot, two main things are done when the integration is enabled:
-
The default
LoginFlowIndexView
view is replaced. This view is called when you submit the login form. The replacement for this view,RequestLoginFlowResourceView
, simply adds the HTTP Request to the context. This context is passed to authentication Providers.Normally the Request is not included, as none of the providers require it.
-
The Header Authentication Provider is injected into the providers, before the other authentication providers.
This ensures that Header auth is tried first, and if it fails the user can still use username/password.
If anything goes wrong or Home Assistant fails to load the component correctly, simply remove the auth_header
block from your configuration file and restart HASS.