search

home-assistant / android

:iphone: Home Assistant Companion for Android
https://companion.home-assistant.io/
Apache License 2.0
2.32k stars 644 forks source link

Support for APIs behind Identity Aware Proxy #151

Closed yegle closed 4 years ago

yegle commented 4 years ago

An identity-aware proxy is a safe way to expose your web service/API/website to public network.

It works like this:

  1. The IAP sits between the client and the web server, act as a reverse proxy.
  2. When the client (usually a browser) connects to IAP, IAP will check the cookie and see if the user is authenticated. If yes then it acts like a normal reverse proxy.
  3. If not, the IAP redirect to the identity provider (Google, GitHub etc) and finish authentication.

(Pardon my vague description).

I'm currently using pomerium.io (open source IAP). It would be great if the Hass Android app can:

  1. Test the connectivity to the API at the time of adding a Hass server.
  2. If there's a 302 redirect, create a browser window to follow the link (embedded WebView won't work because Google disallow oauth inside embedded browser since ~2017).
  3. Once the workflow is finished, try test connectivity to API again with the additional cookies from the login workflow.

(Pardon again for being vague, not an Android dev. Highly recommend any devs to take a look at pomerium.io and test out).

balloob commented 4 years ago

Since the login workflow with Google cannot be run within an embedded webview, there is no way for us to intercept the cookies.

If it were possible to intercept cookies, it would complicate the app a lot. This is not something we should add to the official app.

This is a duplicate of #45

yegle commented 4 years ago

FWIW, there is a login API for Pomerium that doesn't rely on using embedded browser to authenticate with Google: https://www.pomerium.io/docs/reference/programmatic-access.html

Is this something that Home Assistant Android app would like to support?

yegle commented 4 years ago

Actually I think if Chrome Custom Tabs are used, the cookies are automatically shared with Chrome and problem solved?

https://developer.chrome.com/multidevice/android/customtabs

manutenfruits commented 4 years ago

Have Chrome Custom Tabs been looked into for this issue? I think they would fix the issue and make Home Assistant Companion possible for those that have Identity-Aware Proxies.

AndrewDaws commented 3 years ago

A lot of other apps use Custom Tabs for exactly this reason, and it's not just specific to Chrome.

https://developers.google.com/web/android/custom-tabs

This issue really should be re-opened since there is definitely a solution to this problem. This issue also prevents people (like me!) from being able to use the Android app at all due to it not supporting any sort of authentication providers/proxies being put in front of Home Assistant to secure it from the outside world.