#How to programmatically change a user’s password

1 messages · Page 1 of 1 (latest)

terse oxide
#

Hello. My task is: to temporarily grant access to home assistant for one user, for example for 1 day. After that, the user should lose his right to enter the XA website.
As an idea, I think, is it possible to generate new passwords for this user every day? I want to transfer passwords via API from CRM. Or are there other ways to implement this?

vagrant obsidian
#

what is your actual use case here?

terse oxide
vagrant obsidian
#

what's the situation, the problem and the desired outcome

#

The XY problem is a communication problem encountered in help desk, technical support, software engineering, or customer service situations where the question is about an end user's attempted solution (X) rather than the root problem itself (Y or Why?).

terse oxide
vagrant obsidian
#

this is not really something that home assistant is designed for. it does not have RBAC so if you have 1 big HA server it would be very easy for quests to mess with devices in other rooms if you let them log in

terse oxide
vagrant obsidian
#

you could have separate instances for each room i guess. but people could still potentially mess with stuff so you would probably want to have a freshly configured system for each new guest. (snapshot on proxmox maybe?)
as for setting a user password. you can do this on the ha-cli in haos.
you could open ssh access to haos directly - theres methods of doing this on port 22222. then load the ha-cli and use the password reset command auth reset --username 'existing_user' --password 'new_password'

#

so you could make a script to reload the instance from a known working install, then ssh in and send the commands to set a random password

#

is it critical that the guests are able to access on their own device? for physical access or something?
a better solution would be a wall mounted tablet that is in kiosk mode that shows only the dashboard for their room

#

another approach would be to write your own frontend system which can serve as the RBAC and send stuff back to HA to do stuff.

however all of these ideas are not recommended and are wildly unsupported

terse oxide
terse oxide
vagrant obsidian
#

okay so, you could use the shell_command integration to call the auth script

#

documentation shows it runs in the home assistant container context

terse oxide
vagrant obsidian
#

so you would want somethhing like this -

  newpassword: hass --script auth --config /config change_password existing_user new_password```
#

the issue you have is that its a fixed command

#

maybe you could write a script which shell_command calls which would itself generate random password, sets it and then responds with the password which feeds up to an automation that calls it which then sends the password somewhere

terse oxide
terse oxide
vagrant obsidian
terse oxide
vagrant obsidian
#

you can do it from there i beleive

#

first you need to ensure that addon is not running in protection mode which it is by default for security

#

then you will be able to access the homeassistant container enviroment with docker exec -it homeassistant bash then you should be able to use hass --script auth --config /config change_password existing_user new_password

terse oxide
vagrant obsidian
#

in the addon configuration

terse oxide
vagrant obsidian
terse oxide
vagrant obsidian
little scroll
ripe roost
#

Even if you do write your own app, just be aware that the credentials that app uses to communicate with the server are the same credentials that user can use to have full access to everything via the backend APIs. So it's security through obscurity at best.

little scroll