Authelia Guide

Authelia is an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role of information security in providing multi-factor authentication and single sign-on (SSO) for your applications via a web portal. Authelia is an OpenID Connect 1.0 Provider which is OpenID Certified™ allowing comprehensive integrations, and acts as a companion for common reverse proxies.

Home Assistant configuration

Read hass-openid documentation first.

Use configure_url with Authelia.

openid:
  client_id: "YOUR_CLIENT_ID"
  client_secret: !secret openid_client_secret
  configure_url: "https://YOUR_IDP_DOMAIN/.well-known/openid-configuration"
  username_field: "preferred_username"  # Adjust based on your IdP's user info response
  scope: "openid profile email"
  block_login: false
  trusted_ips: # List of CIDR blocks that are not affected by block_login
     - "192.168.2.0/24"
     - "192.168.2.5/32"
     - "10.0.0.0/8"
  openid_text: "Login with Authelia"  # Text to display on the login page
  create_user: true  # Automatically create users on first login

Authelia configuration

In Authelia, edit configuration.yaml and add a new client.

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:

    ### HomeAssistant
      - client_id: 'YOUR_CLIENT_ID'
        client_name: 'Home Assistant'
        client_secret: 'YOUR_CLIENT_SECRET'
        public: false
        # Until this feature is available, you must not enable PKCE
        # https://github.com/cavefire/hass-openid/issues/25
        #require_pkce: true
        #pkce_challenge_method: 'S256'                                                                                                                                                                               
        authorization_policy: 'two_factor'
        redirect_uris:
          - 'https://YOUR_HA_DOMAIN/auth/openid/callback'
        scopes:
          - 'email'
          - 'openid'
          - 'profile'
          - 'groups'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'

Until this feature is available, you must not enable PKCE.