[implemented]User access control

---

Hi,

I was wondering wether it is possible to restrict the number over viewable pages a user can see. I’m looking for a way to add a user who can only control a few devices, not all.

In premission configuration I do not currently see a way to do this. But maybe I’m not looking at it in the right way.

If someone has a solution, I would love to hear it.

Regards,

Ruud

Currently not possible.
You can restrict if a user can control devices or not. But not on a per device or a per page base.

This is a feature request which I’ve seen at least twice before. I do agree with this one too.

It would have been better to place it under https://forum.pimatic.org/category/14/feature-requests

@ruudvddries This feature has been implemented as part of pimatic@0.9.36. For a page the “allowedRoles” property can be set to a list of user ids which shall be granted access. In the example shown below, the page “dash” is only visible to user “pi”:

"pages": [
    {
      "id": "dash",
      "name": "dash",
      "allowedRoles": [
        "pi"
      ],
      "devices": [
        {
          "deviceId": "system-sensor"
        }
      ]
    },
...
  ],

@mwittig It would be nice, if this could be configured using the mobile frontend.

Does “allowedRoles” mean that these users can change devices? Or is that based on the normal rules and does this only mean that “non-admins” can view the page?
ruddvddries asks for "…viewable pages a user can see. I’m looking for a way to add a user who can only control a few devices, not all."
That is not consistent as he asks for “viewable” and at the same time “control a few devices”.

@Harry-van-der-Wolf said in [implemented]User access control:

Does “allowedRoles” mean that these users can change devices?

No. It is only about the visibility of the page. If a user can’t access the page, the devices mapped to this page are accessible depending on user’s role access rights.

Good. That is very useful. Thank you.

would be nice in some further development to implement this acces control to the page setup via checkboxes to click which roles should be disabled or enabled from access.
now that pimatic v0.9 is getting more and more configurable over gui, we should try to implement such major options to the gui too.

@mwittig Great! Amazing to see all the work is done by you all. I should really find some time (and knowledge) to contribute myself, and create a Nest-Thermostat plugin…

Again, big thanks!

Regards,

Ruud

@mwittig said in [implemented]User access control:

@ruudvddries This feature has been implemented as part of pimatic@0.9.36. For a page the “allowedRoles” property can be set to a list of user ids which shall be granted access. In the example shown below, the page “dash” is only visible to user “pi”:

"pages": [
    {
      "id": "dash",
      "name": "dash",
      "allowedRoles": [
        "pi"
      ],
      "devices": [
        {
          "deviceId": "system-sensor"
        }
      ]
    },
...
  ],

@ruudvddries said in [implemented]User access control:

I should really find some time (and knowledge) to contribute myself, and create a Nest-Thermostat plugin…

This would be really nice. There is an orphaned (and potentially outdated) plugin project for nest. Maybe this is a good starting point.

@mwittig Yes, I know. I already checked with the John. It should be fairly easy…but it still feels like I have to take a big hurdle before getting it to work. But it would be a nice learning traject…"

“”""""""""""""
Mailsnippet

Ruud,

Last time I looked at this was a long while back but I’m nearly certain it was incomplete - the small library I wrote got the basic API down but I never built out from there. It should be a very basic and easy to understand - plugging it into pimatric and getting all the details out further could likely be the task you’re left with. Best of luck!

-John
"""""""""""""""

I wanted to use allowedRoles for 1 page. But the allowed user (pi) cant see the page. A another user cant see the page too.

Dis is my Config :

  {
  "id": "testbereich",
  "name": "Automation / Überwachung",
  "allowedRoles": [
    "pi"
  ],
  "devices": [
    {
      "deviceId": "HKautomatic"
    },
    {...

Can you help me ?

@Arlive said in [implemented]User access control:

pi

Is “pi” the username you use to login to pimatic via web?

@mwittig said in [implemented]User access control:

@Arlive said in [implemented]User access control:

pi

Is “pi” the username you use to login to pimatic via web?

Yes

@Arlive Is the role you have assigned to your user “pi” restricted? If yes, can you please post the role definitions (settings.roles)?

@mwittig said in [implemented]User access control:

@Arlive Is the role you have assigned to your user “pi” restricted? If yes, can you please post the role definitions (settings.roles)?

No , its a admin.

“roles”: [
{
“name”: “admin”,
“permissions”: {
“pages”: “write”,
“rules”: “write”,
“variables”: “write”,
“messages”: “write”,
“events”: “write”,
“devices”: “write”,
“groups”: “write”,
“plugins”: “write”,
“database”: “write”,
“config”: “write”,
“updates”: “write”,
“controlDevices”: true,
“restart”: true
}
},

@Arlive Ah, ok. I think you have mixed up “user” versus “role”. “allowedRoles” takes a list of roles to which page access will be granted.

The following works for me:

  "pages": [
    {
      "id": "dash",
      "name": "dash",
      "allowedRoles": [
        "user"
      ],
      
     ....

"users": [
    {
      "username": "admin",
      "password": "xxxxxxxxxx",
      "role": "admin"
    },
    {
      "username": "pi",
      "password": "xxxxxxxxxx",
      "role": "user"
    }
  ],

...

"roles": [
    {
      "name": "admin",
      "permissions": {
        "pages": "write",
        "rules": "write",
        "variables": "write",
        "messages": "write",
        "events": "write",
        "devices": "write",
        "groups": "write",
        "plugins": "write",
        "updates": "write",
        "database": "write",
        "config": "write",
        "controlDevices": true,
        "restart": true
      }
    },
    {
      "name": "user",
      "permissions": {
        "pages": "write",
        "rules": "write",
        "variables": "write",
        "messages": "write",
        "events": "write",
        "devices": "write",
        "groups": "write",
        "plugins": "write",
        "updates": "write",
        "database": "write",
        "config": "write",
        "controlDevices": true,
        "restart": true
      }
    }
  ],

Ahh okay, now i understand this. Now it works ! Thanks