search

genielabs / HomeGenie

HomeGenie, the programmable automation intelligence
https://homegenie.it
GNU General Public License v3.0
388 stars 154 forks source link

deprecated HTTP Basic authentication? #377

Closed tuicemen closed 4 years ago

tuicemen commented 5 years ago

Looking over the change log for 1.3-beta.1 I seen lots of additions adds for WebSocketGateway and token authorization. @genemars Since I like to have Authorization setup for HG as I'm sure other do as well perhaps you can explain this. Or may be it isn't fully implemented yet as going to /api/HomeAutomation.HomeGenie/Config/WebSocket.GetToken doesn't give much value ="" and if it did give a token how do I utilize it.

For now my internet accessible HG remains at version 1.2-Stable.39 until I have this all figured out.

genemars commented 5 years ago

Hi @tuicemen, Basic authentication can be still enabled by editing the system_settings.xml file. If you prefer for some reason using Basic authentication you can add this option:

<Option Name="Authentication" Value="Basic" />

in the systemconfig.xml WebServiceGateway Options. Be aware that using Basic authentication the password will be sent in clear. With the new authentication method (Digest) everything is encrypted. The authentication token is only used for connecting to the WebSocketGateway which is not actually used in current HG version, but there's a test CLI page that can be used to monitor HomeGenie events and issue API commands directly: http://<your_homegenie_address>/hg/html/cli.html . I just noticed there's a bug on the CLI because the address is hard coded, but it still gives you an idea about how the token is being used: https://github.com/genielabs/HomeGenie/blob/master/BaseFiles/Common/html/cli.html#L53 You can fix yourself the cli.html file by removing the http://192.168.2.104:8080 string from the URL used to obtain the token. I already fixed this locally and I will publish the new version soon. Another example using HomeGenie WebSocket interface is the new UI which is not yet ready for the public as it also contains a few lines of hard-coded stuff and a moked configuration with a few modules and groups. Anyway there's a public URL to see the progress of the homegenie-web-ui project: https://genielabs.github.io/homegenie-web-ui/ Soon I'll add to it a connection wizard that will prompt the user for HomeGenie server address so that it can be used by everyone with a real configuration. The only implemented widgets in the new UI are: switch, dimmer and light. Once I succeed consolidating the code I will go ahead and implemnts all other widgets.

genemars commented 5 years ago

@tuicemen I forgot to mention that if you are not running a fresh install you'll also have to manually add the WebServiceGateway to the systemsetting.xml file as shown here: https://github.com/genielabs/HomeGenie/blob/master/BaseFiles/Common/systemconfig.xml#L66

tuicemen commented 5 years ago

@genemars thanks for the details. I'll try to play with the WebServiceGateway but I may have to wait till your next release. The new UI looks nice and clean. I'm now curious to see what my setup would look like running it. Can't wait for the connection wizard.

genemars commented 5 years ago

@tuiceman btw the wizard will be very similar to the one already implemented in the android app, but it will not probably have the automatic discovery facility.

saue0 commented 5 years ago

Can we use the token for accessing the "WebServiceGateway" or is it only for the "WebSocketGateway", I'm developping a Google Home interface and it require a clous service. AND i dont like to have to keep the user and password in my cloud. Do you have an interesr for OAUTH2 authentification ? Thanks

genemars commented 5 years ago

OAuth2 authentication could be added but then also SSL should be implemented. The latter is not a easy task unless this is achieved using an external utility such as stunnel for linux.