website/integrations: Update Home Assistant integration docs #12233

sbogomolov · 2024-11-30T18:15:20Z

Extra care should be taken to proxy through Authentik only prefixes starting with /auth (excluding prefixes starting with /auth/token). If everything is proxied - things break.

See BeryJu/hass-auth-header#212.

netlify · 2024-11-30T18:15:39Z

✅ Deploy Preview for authentik-docs canceled.

Name	Link
🔨 Latest commit	`79bcf43`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-docs/deploys/67573c6afd9ae9000732c6d3

netlify · 2024-11-30T18:15:44Z

✅ Deploy Preview for authentik-storybook canceled.

Name	Link
🔨 Latest commit	`79bcf43`
🔍 Latest deploy log	https://app.netlify.com/sites/authentik-storybook/deploys/67573c6a8353c60008ce6af4

tanberry · 2024-12-02T22:03:34Z

website/integrations/services/home-assistant/index.md

@@ -16,6 +16,9 @@ sidebar_label: Home Assistant
 :::caution
 You might run into CSRF errors, this is caused by a technology Home-assistant uses and not authentik, see [this GitHub issue](https://github.com/goauthentik/authentik/issues/884#issuecomment-851542477).
 :::
+:::caution
+Only `/auth` needs to proxied (excluding `/auth/token`), see [this GitHub issue](https://github.com/BeryJu/hass-auth-header/issues/212).


Thanks for this important addition! Can you explain a little more what you mean by "excluding /auth/token please?

Sure. That means we should proxy all prefixes starting with /auth except /auth/token.

Thanks @sbogomolov I appreciate that clarification. This is an area I am trying to learn more about, but not fully there yet, lol.

We do need to provide the reader with info on how to accomplish this task of "proxying the prefixes". Let's add some basic info about how/where to do this in authentik. Let's also add the an example list of prefixes (taken from the Issue #1842 .

Suggested change

Only `/auth` needs to proxied (excluding `/auth/token`), see [this GitHub issue](https://github.com/BeryJu/hass-auth-header/issues/212).

You can use the **Unauthenticated Paths** setting in the proxy provider to define regular expressions for which authentication via a proxy is not required. Typically, only `/auth` prefixes needs to proxied (excluding `/auth/token`).

<img width="1219" alt="Screenshot 2024-12-03 at 2 53 31 PM" src="https://github.com/user-attachments/assets/14fa005a-257a-4239-84d8-a406b3517487">

For more information refer to [GitHub issue #212](https://github.com/BeryJu/hass-auth-header/issues/212).

Please review carefully, to verify that my suggestion is accurate (using the Unauthenticated Paths field to add any prefixes that do not need to be proxied) and my attempt at adding escapes to the wildcards in the prefixes. @BeryJu can you also please look over this suggested wording?

To be honest, I managed to do this via Traefik's Ingress Route setup. I did not know I can do this in authentik :) Here is what I did:

routes: - kind: Rule match: Host(`ha.domain.tld`) services: - name: ha port: http - kind: Rule match: Host(`ha.domain.tld`) && PathPrefix(`/auth`) middlewares: - name: authentik namespace: authentik services: - name: ha port: http - kind: Rule match: Host(`ha.domain.tld`) && PathPrefix(`/auth/token`) services: - name: ha port: http - kind: Rule match: Host(`ha.domain.tld`) && PathPrefix(`/outpost.goauthentik.io/`) services: - name: authentik-server namespace: authentik port: http nativeLB: true

I have tried adding this list to Unauthenticated Paths and removing my workaround in IngressRoute:

^/api.* ^/auth/token.* ^/.external_auth=. ^/service_worker.js ^/static.* ^/local.* ^/hacsfiles.* ^/frontend_latest.*

It did not work. I see that requests to /api/... return 401 Unauthorized.

Ah, okay, thanks very much for that feedback @sbogomolov. I hadn't realized you'd configured it in Traefik, makes perfect sense.

I think for now it's best if we go back to your original wording, but please clarify that this can be set in a reverse proxy (such as Traefik) OR in authentik (on the Proxy Provider), and we get this PR merged. I'll ask Engineering to test what you found; if you have any info to share you could open an Issue and describe what happened when you tried to use the Unauthenticated Paths field in authentik. Thanks so much for this contribution, and for your patience with working out the details.

I have updated the wording. Let me know what you think.

codecov · 2024-12-03T19:11:32Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.70%. Comparing base (13b2543) to head (79bcf43).
Report is 79 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12233      +/-   ##
==========================================
+ Coverage   92.60%   92.70%   +0.09%     
==========================================
  Files         761      762       +1     
  Lines       38050    38156     +106     
==========================================
+ Hits        35238    35373     +135     
+ Misses       2812     2783      -29

Flag	Coverage Δ
e2e	`49.15% <ø> (+0.03%)`	⬆️
integration	`24.76% <ø> (-0.07%)`	⬇️
unit	`90.22% <ø> (+0.02%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

website/integrations/services/home-assistant/index.md

tanberry

Thanks! LGTM!

tanberry · 2024-12-05T20:48:16Z

Ach. The build check for lint (prettier-check) is failing. Did you run make website before pushing, after fixing the capitalization?

If you did run it, you might need to upgrade our build package by running make website-install and then running make website again. Sorry for the problems @sbogomolov , let me know how that goes.

sbogomolov · 2024-12-05T23:20:57Z

I have just run make website-install followed by make website. None of the files were modified. Should I check something specific?

EDIT: I have also tried running make website-lint-fix - no changes.

sbogomolov · 2024-12-09T18:49:25Z

Something must be off with that check. I have run it manually and it was successful:

$ npm run prettier-check

> @goauthentik/[email protected] prettier-check
> prettier --check .

Checking formatting...
All matched files use Prettier code style!

Also, the failed check shows problems with file I have not touched:

Checking formatting...
[warn] docs/add-secure-apps/providers/proxy/_traefik_ingress.md
[warn] Code style issues found in the above file. Run Prettier with --write to fix.
Error: Process completed with exit code 1.

@tanberry I'm not sure what else I can do here...

Extra care should be taken to proxy only /auth endpoint through Authentik. Signed-off-by: Sergii Bogomolov <[email protected]> Co-authored-by: Tana M Berry <[email protected]> Signed-off-by: Sergii Bogomolov <[email protected]>

tanberry · 2024-12-16T14:38:58Z

Thank you for your patience on this one, @sbogomolov and thank you for adding this important integration guide!

sbogomolov requested a review from a team as a code owner November 30, 2024 18:15

BeryJu changed the title ~~Update Home Assistant integration docs~~ website/integrations: Update Home Assistant integration docs Dec 1, 2024

tanberry reviewed Dec 2, 2024

View reviewed changes

sbogomolov force-pushed the ha-integration-auth branch from d8513e0 to 1427273 Compare December 5, 2024 18:25

tanberry reviewed Dec 5, 2024

View reviewed changes

website/integrations/services/home-assistant/index.md Outdated Show resolved Hide resolved

tanberry approved these changes Dec 5, 2024

View reviewed changes

Update Home Assistant integration docs

79bcf43

Extra care should be taken to proxy only /auth endpoint through Authentik. Signed-off-by: Sergii Bogomolov <[email protected]> Co-authored-by: Tana M Berry <[email protected]> Signed-off-by: Sergii Bogomolov <[email protected]>

sbogomolov force-pushed the ha-integration-auth branch from 4c50feb to 79bcf43 Compare December 9, 2024 18:52

tanberry enabled auto-merge (squash) December 16, 2024 14:39

tanberry merged commit 0bc2d4a into goauthentik:main Dec 16, 2024
60 of 66 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

website/integrations: Update Home Assistant integration docs #12233

website/integrations: Update Home Assistant integration docs #12233

sbogomolov commented Nov 30, 2024 •

edited

Loading

netlify bot commented Nov 30, 2024 •

edited

Loading

netlify bot commented Nov 30, 2024 •

edited

Loading

tanberry Dec 2, 2024

sbogomolov Dec 3, 2024 •

edited

Loading

tanberry Dec 3, 2024 •

edited

Loading

tanberry Dec 3, 2024 •

edited

Loading

tanberry Dec 3, 2024

sbogomolov Dec 3, 2024

sbogomolov Dec 4, 2024

tanberry Dec 4, 2024

sbogomolov Dec 5, 2024

codecov bot commented Dec 3, 2024 •

edited

Loading

tanberry left a comment

tanberry commented Dec 5, 2024 •

edited

Loading

sbogomolov commented Dec 5, 2024 •

edited

Loading

sbogomolov commented Dec 9, 2024 •

edited

Loading

tanberry commented Dec 16, 2024

-Only `/auth` needs to proxied (excluding `/auth/token`), see [this GitHub issue](https://github.com/BeryJu/hass-auth-header/issues/212).
+You can use the **Unauthenticated Paths** setting in the proxy provider to define regular expressions for which authentication via a proxy is not required. Typically, only `/auth` prefixes needs to proxied (excluding `/auth/token`).
+<img width="1219" alt="Screenshot 2024-12-03 at 2 53 31 PM" src="https://github.com/user-attachments/assets/14fa005a-257a-4239-84d8-a406b3517487">
+For more information refer to [GitHub issue #212](https://github.com/BeryJu/hass-auth-header/issues/212).

website/integrations: Update Home Assistant integration docs #12233

website/integrations: Update Home Assistant integration docs #12233

Conversation

sbogomolov commented Nov 30, 2024 • edited Loading

netlify bot commented Nov 30, 2024 • edited Loading

✅ Deploy Preview for authentik-docs canceled.

netlify bot commented Nov 30, 2024 • edited Loading

✅ Deploy Preview for authentik-storybook canceled.

tanberry Dec 2, 2024

Choose a reason for hiding this comment

sbogomolov Dec 3, 2024 • edited Loading

Choose a reason for hiding this comment

tanberry Dec 3, 2024 • edited Loading

Choose a reason for hiding this comment

tanberry Dec 3, 2024 • edited Loading

Choose a reason for hiding this comment

tanberry Dec 3, 2024

Choose a reason for hiding this comment

sbogomolov Dec 3, 2024

Choose a reason for hiding this comment

sbogomolov Dec 4, 2024

Choose a reason for hiding this comment

tanberry Dec 4, 2024

Choose a reason for hiding this comment

sbogomolov Dec 5, 2024

Choose a reason for hiding this comment

codecov bot commented Dec 3, 2024 • edited Loading

Codecov Report

tanberry left a comment

Choose a reason for hiding this comment

tanberry commented Dec 5, 2024 • edited Loading

sbogomolov commented Dec 5, 2024 • edited Loading

sbogomolov commented Dec 9, 2024 • edited Loading

tanberry commented Dec 16, 2024

sbogomolov commented Nov 30, 2024 •

edited

Loading

netlify bot commented Nov 30, 2024 •

edited

Loading

netlify bot commented Nov 30, 2024 •

edited

Loading

sbogomolov Dec 3, 2024 •

edited

Loading

tanberry Dec 3, 2024 •

edited

Loading

tanberry Dec 3, 2024 •

edited

Loading

codecov bot commented Dec 3, 2024 •

edited

Loading

tanberry commented Dec 5, 2024 •

edited

Loading

sbogomolov commented Dec 5, 2024 •

edited

Loading

sbogomolov commented Dec 9, 2024 •

edited

Loading