{"id":25666534,"url":"https://github.com/losenmann/hacs-auth-aaa","last_synced_at":"2026-04-28T17:32:20.718Z","repository":{"id":279269868,"uuid":"933599387","full_name":"Losenmann/hacs-auth-aaa","owner":"Losenmann","description":"Python script for Home Assistant that adding AAA authentication","archived":false,"fork":false,"pushed_at":"2025-02-24T17:17:44.000Z","size":185,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-06-05T07:59:04.386Z","etag":null,"topics":["aaa","hacs-default","home-assistant","ldap","radius"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Losenmann.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-02-16T11:12:25.000Z","updated_at":"2025-02-24T17:17:47.000Z","dependencies_parsed_at":"2025-02-24T18:36:49.066Z","dependency_job_id":null,"html_url":"https://github.com/Losenmann/hacs-auth-aaa","commit_stats":null,"previous_names":["losenmann/hacs-auth-aaa"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Losenmann/hacs-auth-aaa","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Losenmann%2Fhacs-auth-aaa","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Losenmann%2Fhacs-auth-aaa/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Losenmann%2Fhacs-auth-aaa/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Losenmann%2Fhacs-auth-aaa/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Losenmann","download_url":"https://codeload.github.com/Losenmann/hacs-auth-aaa/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Losenmann%2Fhacs-auth-aaa/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32392292,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-28T14:34:11.604Z","status":"ssl_error","status_checked_at":"2026-04-28T14:32:37.009Z","response_time":56,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aaa","hacs-default","home-assistant","ldap","radius"],"created_at":"2025-02-24T08:30:46.330Z","updated_at":"2026-04-28T17:32:20.703Z","avatar_url":"https://github.com/Losenmann.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Auth AAA\n[![Python](https://img.shields.io/badge/python-3670A0?style=for-the-badge\u0026logo=python\u0026logoColor=ffdd54)](https://www.python.org)\n[![Home Assistant](https://img.shields.io/badge/home_assistant-41BDF5.svg?style=for-the-badge\u0026logo=home-assistant\u0026logoColor=white)](https://www.home-assistant.io)\n[![HACS](https://img.shields.io/badge/hacs-python_scripts-41BDF5.svg?style=for-the-badge)](https://hacs.xyz/docs/use/repositories/type/python_script/)\n[![Release](https://img.shields.io/github/release/Losenmann/hacs-auth-aaa/all.svg?style=for-the-badge)](https://github.com/Losenmann/hacs-auth-aaa/releases)\n[![Maintainer](https://img.shields.io/badge/maintainer-@losenmann-FF6E00?style=for-the-badge)](https://github.com/Losenmann)\n[![Donate](https://img.shields.io/badge/donate-yoomoney-8B3FFD.svg?style=for-the-badge)](https://yoomoney.ru/to/410015216730856)\n\nPython script for Home Assistant adding authentication via RADIUS or LDAP\\\nThe project is based on the library [pyrad](https://github.com/pyradius/pyrad.git)\n\n## Overview\nThe script is designed to authenticate users in Home Assistant via a RADIUS or LDAP.\\\nThis allows you to centrally manage user access.\\\nThe script supports 2 launch modes: [auth_providers](#usage-in-auth_provider-mode) and [CLI](#usage-in-cli-mode).\\\nAdditional information about the mode [auth_providers](https://www.home-assistant.io/docs/authentication/providers/#command-line)\n\n## Install\n[![](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=losenmann\u0026repository=hacs-auth-aaa\u0026category=python_script)\n\n- **Method 1.** [HACS](https://hacs.xyz) \u003e Python Script \u003e Add \u003e Auth AAA \u003e Install\n\n- **Method 2.** Copy the manually  `auth-aaa.py` from [latest release](https://github.com/losenmann/iptv-toolkit/releases/latest/download/auth-aaa.py) to path `/config/python_scripts`:\n    ```sh\n    wget -LP /config/python_scripts \"https://github.com/losenmann/iptv-toolkit/releases/latest/download/auth-aaa.py\"`\n    ```\n\n## Usage in auth_provider mode\n### Setupe\n#### **Home Assistant**\n1. Set connection parameters in the `secrets.yaml` file. Example data:\n   ```yaml\n   auth_aaa_server: \"server.example.com\"\n   auth_aaa_radius_secret: \"homeassistant\"\n   auth_aaa_ldap_userdn: \"uid={},ou=people,dc=example,dc=com\"\n   auth_aaa_ldap_basedn: \"ou=people,dc=example,dc=com\"\n   auth_aaa_ldap_filter: \"(uid={})\"\n   auth_aaa_ldap_attrib: [\"givenName\",\"memberof\"]\n   ```\n\u003e [!IMPORTANT]\n\u003e {} - is replaced by the username.\n\n2. In the `configuration.yaml` file add the configuration, the authentication order matters:\n   ```yaml\n   homeassistant:\n     auth_providers:\n       - type: command_line\n         command: '/usr/local/bin/python'\n         args: ['/config/python_scripts/auth-aaa.py', '-m']\n         meta: true\n       - type: homeassistant\n   ```\n\u003e [!NOTE]\n\u003e The `meta: true` directive is responsible for writing some variables to standard output to populate the user account created in Home Assistant with additional data. Removing the directive will disable authorization in Home Assistant using the script.\\\n\u003e The script supports running as an executable file for this you need to set execution rights. By default, HACS removes permission data.\n\n#### **IF USED RADIUS**\n   1. Add data from the file [dictionary](./dictionary) to the RADIUS server's `dictionary` file.\n   2. Set the user's `Hass-Group` attribute to `system-users`:\n\n      | Attribute | Type | Value | Description |\n      | :-- | :--: | :-----: | :---------- |\n      | `Hass-Group` | string | `system-users` \u003cbr\u003e `system-admin` | User group (Default `system-users`) |\n      | `Hass-Local-Only` | byte | `0` \u003cbr\u003e `1` | Local login only \u003cbr\u003e (Defaults `0`) |\n      | `Hass-Is-Active` | byte  | `0` \u003cbr\u003e `1` | Activate user account \u003cbr\u003e (Defaults `1`) |\n\u003e [!WARNING]\n\u003e For correct operation RADIUS Authorization , you must add to the [dictionary](./dictionary) in the RADIUS server dictionary file.\n\u003cdetails\u003e\u003csummary\u003eFor owners device MikroTik\u003c/summary\u003e\n\n   1. Install `user-manager` package:\n      ```rsc\n      /tool/fetch mode=https url=(\"https://download.mikrotik.com/routeros/\".[/system/routerboard/get upgrade-firmware].\"/user-manager-\".[/system/routerboard/get upgrade-firmware].\"-\".[/system/resource/get architecture-name].\".npk\") output=file\n      /system/reboot\n       ```\n   2. Setup a `user-manager`:\n      ```rsc\n      /user-manager/attribute/add name=\"Hass-Group\" vendor-id=812300 type-id=1 value-type=string\n      /user-manager/attribute/add name=\"Hass-Local-Only\" vendor-id=812300 type-id=2 value-type=hex\n      /user-manager/attribute/add name=\"Hass-Is-Active\" vendor-id=812300 type-id=3 value-type=hex\n      /user-manager/user/add name=\"homeassistant-test\" password=\"homeassistant\" attributes=\"Hass-Group:system-users,Hass-Local-Only:0,Hass-Is-Active:1\"\n      /user-manager/router/add name=\"homeassistant-router\" shared-secret=\"homeassistant\" address=\"\u003cyour_subnet\u003e\"\n      ```\n\n\u003c/details\u003e\n\n#### **IF USED LDAP**\n\u003e [!CAUTION]\n\u003e Authentication method via ldap in development.\n\nThe LDAP server must support the `memberof` module. There should be an entry in the configuration: `olcModuleload: memberof.so`.\\\nIn Alpine Linux, the module can be installed like this: `apk add openldap-overlay-memberof`.\n\nThe structure of the LDAP tree should look like this:\n```\ncn=system-admin,cn=homeassistant,dc=example,dc=com\ncn=system-users,cn=homeassistant,dc=example,dc=com\n```\n\nUsers can be added to a parent group:\n```\ncn=homeassistant,dc=example,dc=com\n```\nIn this case, members of the parent group will have rights `system-users`.\n\nProspective users must have the following attributes:\n- uid\n- givenName\n- memberof\n\nIf the `givenName` attribute is missing, then the login will be used as the username.\n\n## Usage in CLI mode\nIn CLI mode, you need to set execution permissions `chmod +x ./python_scripts/auth-aaa.py`.\\\nOr run via Python `python ./python_scripts/auth-aaa.py`.\n\u003e [!NOTE]\n\u003e RADIUS connection parameters can be configured in `secrets.yaml`, see point 1 of the chapter [Usage in auth_provider mode](#usage-in-auth_provider-mode).\n```\n./python_scripts/auth-aaa.py -U 'username' -P 'password' -S 'server.example.com' -s 'secret'\n```\n\n## Script arguments\n| key  | secrets                  | type    | required | description |\n| :--- | :----------------------: | :----:  | :------: | :---------- |\n| `-h` | `none`                   | boolean | no       | Get help information |\n| `-m` | `none`                   | boolean | no       | Enable meta to output credentials to stdout \u003cbr\u003e (Defaults to False) |\n| `-t` | `none`                   | string  | no       | Set type AAA `RADIUS` or `LDAP` \u003cbr\u003e (Defaults to `RADIUS`) |\n| `-U` | `none`                   | string  | yes      | Username |\n| `-P` | `none`                   | string  | yes      | Password |\n| `-S` | `auth_aaa_server`        | string  | yes      | Server \u003cbr\u003e (Defaults from `secrets.yaml`) |\n| `-s` | `auth_aaa_radius_secret` | string  | yes      | RADIUS secret \u003cbr\u003e (Defaults from `secrets.yaml`) |\n| `-b` | `auth_aaa_ldap_basedn`   | string  | yes      | LDAP BASE DN \u003cbr\u003e (Defaults from `secrets.yaml`) |\n| `-u` | `auth_aaa_ldap_userdn`   | string  | yes      | LDAP USER DN \u003cbr\u003e (Defaults from `secrets.yaml`) |\n| `-f` | `auth_aaa_ldap_filter`   | string  | no       | LDAP FILTER \u003cbr\u003e (Defaults from `secrets.yaml`) |\n| `-a` | `auth_aaa_ldap_attrib`   | list    | no       | Get an array of attributes |\n\u003e [!IMPORTANT]\n\u003e When using keys, keys take precedence over values ​​from `secrets.yaml` and variables passed from Home Assistant\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flosenmann%2Fhacs-auth-aaa","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flosenmann%2Fhacs-auth-aaa","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flosenmann%2Fhacs-auth-aaa/lists"}