Role access control in Home Assistant: Why it's important.
The lack of role-based access control (RBAC) in Home Assistant is repeatedly criticized: The top topic in the 2024 Month of "What the heck?". Role-based access control could be used to restrict access to certain devices or location data for certain family members or guests. RBAC could not only make Home Assistant more secure, but also accessible for larger installations.
Current status: Administrator vs. user
Currently, users can be added to the administrators group, allowing them to manage users, devices, automations and dashboards:
When creating a new user, a note tells us that more functions can be expected here in the future:
 |
The user group feature is a work in progress. The user will be unable to administer the instance via the UI. We're still auditing all management API endpoints to ensure that they correctly limit access to administrators. |
Although the settings are currently hidden for users, they can still read all entities and change their status.
Why RBAC would be important
- Parents want to allow their children to use certain functions without them being able to access sensitive or private areas.
- Guest access to individual functions.
- Limit control of the system to specific dashboards or functions: As an example of a shared device, see: Home Assistant display - weather station and more
- For possible use in larger environments, e.g. for small companies.
User voices and suggestions
Some users suggest a simple system that at least distinguishes between normal users and administrators. Many voices from the community call for a quick implementation of RBAC. Suggestions range from simple access restrictions to more complex, multi-level access controls. Some users prefer a system that offers different levels of access control depending on their needs.
One possible solution: Remote Home Assistant
As a possible solution at present, several Home Assistant installations could be linked. The users could be created in the respective Home Assistant environment and certain entities could be made available via Remote Home Assistant.
Further links:
- https://community.home-assistant.io/t/wth-no-access-control/802297/13
- Remote Home Assistant https://github.com/custom-components/remote_homeassistant
Conclusion
The introduction of role access controls in Home Assistant is essential for many users in order to make the system secure and family-friendly. The hope is that the developers will listen to the calls of the community and implement this function in the near future.
({{pro_count}})
{{percentage}} % positive
({{con_count}})