# AdminAuth Default Group Read Only access

**URL:** <https://discourse.nodered.org/t/adminauth-default-group-read-only-access/53302>\
**Category:** Core Development\
**Created:** [6 November 2021 17:47 UTC](https://discourse.nodered.org/t/adminauth-default-group-read-only-access/53302 "2021-11-06T17:47:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![LoranMaes](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/loranmaes/32/50560_2.png) [@LoranMaes](https://discourse.nodered.org/u/LoranMaes)\
**Post date:** [6 November 2021 17:47 UTC](https://discourse.nodered.org/t/adminauth-default-group-read-only-access/53302/1 "2021-11-06T17:47:11Z")

</div>

Hi!  
I'm wondering if you can give users (everyone who isn't logged in into admin) permissions to only read the file.  
If I follow the Securing Node-RED file I don't get the right thing because the default user group can still make changes, but they can't manage the palette etc.

This is what I have in my settings.js:

```auto
adminAuth: {
        type: "credentials",
        users: [
        {
            username: "loran",
            password: "$2b$08$BqucBnG7WuGzs.lhSmmnmeL7X80G4Igin8IvMzZ95qsJ/0aWwdUky",
            permissions: "*"
        }
        ],
            default: {
        permissions: "read"
    }
    },

```

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [6 November 2021 19:43 UTC](https://discourse.nodered.org/t/adminauth-default-group-read-only-access/53302/2 "2021-11-06T19:43:51Z")

</div>

Have you tried deploying any changes as a default user?

read-only permission doesn't stop them from making changes in the editor... they just can't deploy those changes to the runtime.

---

<div class="post-metadata">

**Author:** ![LoranMaes](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/loranmaes/32/50560_2.png) [@LoranMaes](https://discourse.nodered.org/u/LoranMaes)\
**Post date:** [6 November 2021 20:51 UTC](https://discourse.nodered.org/t/adminauth-default-group-read-only-access/53302/3 "2021-11-06T20:51:30Z")

</div>

Yes, i found that.  
Is there an option that they can't make changes in the editor?

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [6 November 2021 22:19 UTC](https://discourse.nodered.org/t/adminauth-default-group-read-only-access/53302/4 "2021-11-06T22:19:27Z")

</div>

No, permissions are enforced on deploy

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [5 January 2022 22:20 UTC](https://discourse.nodered.org/t/adminauth-default-group-read-only-access/53302/5 "2022-01-05T22:20:05Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.