$ show christiaangoossens/hass-oidc-auth
This repository is a Home Assistant custom component that implements a full OpenID Connect (OIDC) Client/Relying Party for authentication. It allows Home Assistant users to log in via an external OIDC Identity Provider (IdP) such as Authentik, Authelia, Keycloak, or any standard OIDC-compliant server. The integration registers a custom auth provider within Home Assistant's auth system, intercepts the default login flow to redirect users to the OIDC provider, and handles the full authorization code flow including PKCE (RFC 7636), ID token validation with configurable signing algorithms, and userinfo retrieval. It supports both public and confidential clients, device code flow for mobile app login, automatic user linking, role-based access mapping from IdP groups, and a multi-step UI configuration wizard for easy setup.
The LLM identified 2 files worth highlighting for reuse:
A standalone async OIDC client class that implements the Authorization Code flow with PKCE, discovery document fetching and validation, JWKS fetching and key selection, ID token parsing and verification (including nonce, audience, issuer, and algorithm checks), token endpoint requests, and userinfo endpoint integration. It has minimal coupling to Home Assistant (only for the event loop to load custom TLS certificates) and could be extracted into a generic Python OIDC library with minor adaptations. The code demonstrates strong adherence to RFC 6749, RFC 7636, and OpenID Connect Core 1.0.
A server-side internationalization module that loads JSON translation catalogs asynchronously, resolves the best-matching locale from an Accept-Language header using quality values and regional fallback, and provides a callable Translator object that supports dot-separated key lookup and placeholder formatting. It is fully isolated from Home Assistant (only uses standard library and aiofiles) and can be reused in any async Python web application that needs lightweight i18n without Flask-Babel or similar frameworks.