Home Assistant Single Sign-On with Duende IdentityServer

You can secure Home Assistant with modern authentication features (like passkeys) by integrating Duende IdentityServer as an OAuth provider using HACS. OAuth lets any application sign in with any OAuth provider. This plug-and-play functionality lets you choose an authentication provider that best fits your needs. One common application with a very simple login experience is Home Assistant, the open-source software for managing your home automations through a centralized server.

Home Assistant has built-in authentication providers, but they lack modern authentication features that can improve your security posture, like passkey support. Let’s look at what it takes to secure a Home Assistant instance with an OAuth provider like Duende IdentityServer and gain more control of the login experience.

Setting Up Home Assistant

Before we can plug in Duende IdentityServer, we need to configure Home Assistant with a few customizations. We’ll need Home Assistant set up, plus Home Assistant Community Store (HACS) to let us install a custom extension. We’ll leave you to get those installed and set up yourself; there’s plenty of documentation online:

• Have Home Assistant installed
• Install the Home Assistant Community Store (HACS)

With Home Assistant and HACS up and running, install an extension to add OpenID Connect functionality so we can use our own OAuth provider. To do this, use HACS to install OpenID Connect for Home Assistant using the following steps:

1. Navigate to the HACS dashboard at the URL /hacs/dashboard.
2. In the search bar, type oauth.
3. Select OpenID Connect for Home Assistant and click Download.
4. Navigate to Settings. There should be 1 repair item requesting a restart to enable the new extension. Let it run to configure the extension.

Enabling Your OAuth Provider

With the OpenID Connect extension installed, we can connect Home Assistant to our OAuth provider with the following steps:

• Navigate to Settings -> Devices and services.
• Click the Add integration button.
• Search for openid and select OpenID Connect/SSO Authentication.
• For your provider, select OpenID Connect (SSO).

• Add the Discovery URL for your provider. For our example, we’ll use the demonstration instance of Duende IdentityServer: https://demo.duendesoftware.com/.well-known/openid-configuration

• On the connection verification screen, select Continue Setup.
• When setting up the client, use the Client ID interactive.confidential and Client Secret secret.
• On the next screen, you can choose to link users. We left it disabled for this sample.

Test it out

Now that our own authentication provider is configured, we can test it by logging out of the UI and signing back in. Log out by selecting your account in the bottom-left corner of the screen, and then clicking the Log out button. We’ll see the new login screen, where we can choose between an OpenID Connect flow and the default flow Home Assistant implements.

When clicking the Login with OpenID Connect (SSO) button, we’re redirected to the login page hosted by our authentication provider, in this case the Duende IdentityServer demo site. We’ll log in with one of the hard-coded users with username/password bob/bob.

After signing in, Home Assistant asks if we want to use this device or allow a different device to sign in; we’ll keep using this device.

After that, we have successfully signed in as the hard-coded user Bob Smith.

What did we just configure?

We enabled an extension to hook into Home Assistant and control the sign-in process. All of this is built on pre-configured trust. Home Assistant trusts us, the humans, to install extensions through the store (HACS). We used that trust to install the OpenID Connect/SSO Authentication extension and configured it to trust an external server for signing in.

When we entered the authentication provider’s OpenID configuration URL https://demo.duendesoftware.com/.well-known/openid-configuration, we told Home Assistant to trust that provider. We also made sure the demo instance of Duende IdentityServer could trust our Home Assistant instance when we entered the interactive.confidential client ID and its client secret. The interactive.confidential client is configured by the demo server. When using your own IdentityServer instance, you can use any value for the client ID and client secret. Hopefully something more secure than the secret value secret we use for demo purposes.

Customize Your Own Duende IdentityServer

To keep the example simple, we used the Duende demo site. But you can imagine developing your own Duende IdentityServer instance for the experience you want. The possibilities are endless. Okay, maybe not endless. But there are many, many permutations. So many permutations, you can configure the one that fits your exact use case.

For example, you can store user records in your own custom database schema, use the ASP.NET Identity schema, or use the new Duende User Management feature so modern authentication methods are built in for you, like passkeys and one-time password codes. You can even take it further by developing your own strategy for handing out guest accounts, even adding an expiration date. With this many customizations available, the permutations are many.

And this is a great time to remind you that self hosting Duende IdentityServer for personal projects is free. So you can experiment and play around as much as you want in your home lab.