Form with credentials

Setup, Configuration and Use Items & Sitemaps
1

Dear all,
Can I create a form with credentials.
Imagina that I have a form with switches used for configuration of automations that I don’t want that some members of the family (Kids) have access how can I block their access to it?

Thanks

2

You pretty much have to build the access yourself. perhaps with a reverse proxy server.

3

You did not tell us anything about your setup, but if you just want to avoid internal access I would think about a second LAN by e.g. subnetting.

4

There are many ways this can be implemented but all are outside of openHAB and the topic of this forum. OpenHAB 2.x is insecure by design, unfortunately.

If you wish, contact the openHAB security response team. 2.5.x is covered by the Security policy here.

5

[OffTopic]

You are implying that setting up a reverse proxy is outside the topic of this forum? I think it’s not. You can find tutorials of it here and even a section in the official documentation (following the link you posted).

This is misleading. Nobody has designed it to be insecure. You as a user make it insecure if you set it up as such. Access control just hasn’t been implemented yet. Reasons for it are outside of this topic

I suggest to not contact them. These IMHO are not related.

[OffTopic]

Edit: Typo.

6

No, but subnetting is outside the topic.

7

Hi guys.
apparently I didn’t explain myself well.
What I need is that inside the sitemap of my openhab there is a form that for example is called Configurations which to be accessed I have to enter credentials.

For external access with credentials Im using Nginx that works great.
Thanks

1 Like
8

There is nothing in openHAB like that as far as I know. I was thinking using Nginx to restrict access to that URL.

9

Well … to try to get around things I can create a set of 4 switches that only with a known combination make the form of the Settings visible ando so accessible…

1 Like
10

If all you are concerned about is whether or not the switches or what ever are visible on your sitemap and you are not all that concerned about making access to them really secure, just create a second sitemap that includes those controls and don’t tell anyone about them. It’s about the same amount of security and a heck of a lot less work.

Even better, if you are the only one who will be accessing these controls, don’t put them on the sitemap at all. Just adjust them using the REST API or the Karaf Console. Or set up a HABPanel

1 Like
11

Good Idea.

Thanks