{"id":28368338,"url":"https://github.com/cavefire/hass-openid","last_synced_at":"2026-02-21T22:25:22.778Z","repository":{"id":295204995,"uuid":"989077527","full_name":"cavefire/hass-openid","owner":"cavefire","description":"OIDC integration for Home Assistant","archived":false,"fork":false,"pushed_at":"2025-12-14T11:14:44.000Z","size":48,"stargazers_count":109,"open_issues_count":4,"forks_count":10,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-12-16T15:11:11.897Z","etag":null,"topics":["authentik","custom-integration","homeassistant","keycloak","oauth2","oidc","openid","openid-connect","single-sign-on","sso"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cavefire.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-05-23T14:17:27.000Z","updated_at":"2025-12-15T23:19:05.000Z","dependencies_parsed_at":"2025-05-24T07:38:04.941Z","dependency_job_id":"21e4d279-4267-4c42-8d56-0f09db3d1b1b","html_url":"https://github.com/cavefire/hass-openid","commit_stats":null,"previous_names":["cavefire/hass-openid"],"tags_count":13,"template":false,"template_full_name":null,"purl":"pkg:github/cavefire/hass-openid","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cavefire%2Fhass-openid","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cavefire%2Fhass-openid/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cavefire%2Fhass-openid/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cavefire%2Fhass-openid/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cavefire","download_url":"https://codeload.github.com/cavefire/hass-openid/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cavefire%2Fhass-openid/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29695779,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-21T18:18:25.093Z","status":"ssl_error","status_checked_at":"2026-02-21T18:18:22.435Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentik","custom-integration","homeassistant","keycloak","oauth2","oidc","openid","openid-connect","single-sign-on","sso"],"created_at":"2025-05-29T04:10:33.708Z","updated_at":"2026-02-21T22:25:22.773Z","avatar_url":"https://github.com/cavefire.png","language":"Python","funding_links":[],"categories":["Custom Integrations"],"sub_categories":["🔐 Network \u0026 authentication"],"readme":"# Simple OpenID Connect (OIDC / SSO)\n\nThis integration allows Home Assistant to authenticate users via an OpenID Connect (OIDC) provider. It supports the authorization code flow and integrates seamlessly with Home Assistant's authentication system.\n\nSelection of commonly used OpenID Connect providers:\n- [Keycloak](https://www.keycloak.org/)\n- [Authentik](https://goauthentik.io/)\n- [Google](https://developers.google.com/identity/protocols/oauth2/openid-connect)\n- [Microsoft](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview)\n- and many more...\n\n## Installation\n\n[![Open your Home Assistant instance and open a repository inside the Home Assistant Community Store.](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?category=integration\u0026repository=hass-openid\u0026owner=cavefire)\n\n1. Click the link above to open the integration in HACS.\n2. Install the integration.\n\n### Manual Installation\n\n1. Clone or download this repository.\n2. Copy the `custom_components` directory of this repository to your Home Assistant `config` directory.\n3. Restart Home Assistant.\n\n## Configuration\n\nFirstly you need to configure your IdP. Create an OpenID/OAuth2 provider according to the documentation of your provider.\nNote the client id and client secret as you will need it setting up this integration in Home Assistant. Your provider should be configured to have this callback URL: `https://YOUR_HOME_ASSISTANT_DOMAIN/auth/openid/callback`.\n\n1. Add the following configuration to your `configuration.yaml` file:\n   ```yaml\n   openid:\n     client_id: YOUR_CLIENT_ID\n     client_secret: YOUR_CLIENT_SECRET\n     configure_url: \"https://YOUR_IDP_DOMAIN/.well-known/openid-configuration\"  # Replace with your Identity Provider's URL\n     username_field: \"preferred_username\"  # Adjust based on your IdP's user info response\n     scope: \"openid profile email\"\n     block_login: false\n     trusted_ips: # List of CIDR blocks that are not affected by block_login\n        - \"192.168.2.0/24\"\n        - \"192.168.2.5/32\"\n        - \"10.0.0.0/8\"\n     openid_text: \"Login with OpenID / OAuth2\"  # Text to display on the login page\n     create_user: true  # Automatically create users on first login\n   ```\n2. Replace the placeholders (`YOUR_CLIENT_ID`, `YOUR_CLIENT_SECRET`, etc.) with the details provided by your Identity Provider.\n3. Restart Home Assistant.\n\n\n**username_field**: This is the field in the user info response that Home Assistant will use as the username. Common values are `preferred_username`, `email`, or `sub`. Make sure the value of this field **exactly** matches the username. Otherwise you will get an error, that the account does not exist.\n\n\nNow sign out of Home Assistant and you should see a `OpenID / OAuth2` option on the login page. Click it to be redirected to your Identity Provider for authentication.\n\n### Disable default login\n\nIf you want to disable the default Home Assistant login and only allow OpenID authentication, set `block_login` to `true` in your configuration:\n```yaml\n   openid:\n     ...\n     block_login: true\n     ...\n```\n\nTo allow certain IP ranges to still use the default login (e.g. for local network access), you can specify them in the `trusted_ips` list using CIDR notation.\n```yaml\n   openid:\n     ...\n     block_login: true\n     trusted_ips:\n       - \"192.168.2.0/24\"\n       - \"192.168.2.5/32\"\n       - \"10.0.0.0/8\"\n     ...\n```\n\n**Make sure the OpenID / OAuth2 login works before blocking the default login!** If you block the default login and the OpenID authentication does not work, you will be locked out of your Home Assistant webinterface and will need to manually edit the `configuration.yaml` file to re-enable the default login.\n\n### Alternative Configuration\n\nIf your IdP does not provide a `configure_url`, you can manually specify the endpoints in your configuration:\n```yaml\n   openid:\n     ...\n     authorize_url: \"https://your-idp.com/oauth2/authorize\"\n     token_url: \"https://your-idp.com/oauth2/token\"\n     user_info_url: \"https://your-idp.com/oauth2/userinfo\"\n     ...\n```\n\n## Troubleshooting\n- Verify that the `client_id`, `client_secret`, and URLs in your configuration are correct.\n- Check the Home Assistant logs for any errors or warnings related to the OpenID integration.\n\n  You may want to enable debug logging for the OpenID integration by adding the following to your `configuration.yaml`:\n    ```yaml\n    logger:\n      default: warning\n      logs:\n        custom_components.openid: debug\n    ```\n- If your IdP does not allow client id and client secret to be passed as \"Authorization\" header, you can set `use_auth_header` to `false` in your configuration:\n    ```yaml\n    openid:\n      ...\n      use_auth_header: false\n      ...\n    ```\n\n## Important Notes\n\n- This integration does not require a special proxy configuration (or even a proxy at all) to work.\n- Users must be manually added to Home Assistant.\n- **Blocking a user in your authentication provider will not automatically block them in Home Assistant.** Users will still be able to access Home Assistant as long as their authentication remains valid. It is recommended to block users in Home Assistant as well, if needed.\n\nThis integration is still in early stages of development and there can be issues as well as **security vulnerabilities**. Please use it at your own risk and report any issues you encounter.\n\n## License\nThis project is licensed under GNU GPLv3 - see the [LICENSE](LICENSE) file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcavefire%2Fhass-openid","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcavefire%2Fhass-openid","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcavefire%2Fhass-openid/lists"}