# adminAuth.users\[\].\*.permissions: array or string?

**URL:** <https://discourse.nodered.org/t/adminauth-users-permissions-array-or-string/28164>\
**Category:** General\
**Created:** [11 June 2020 09:45 UTC](https://discourse.nodered.org/t/adminauth-users-permissions-array-or-string/28164 "2020-06-11T09:45:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Redhatter](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/redhatter/32/23748_2.png) [@Redhatter](https://discourse.nodered.org/u/Redhatter)\
**Post date:** [11 June 2020 09:45 UTC](https://discourse.nodered.org/t/adminauth-users-permissions-array-or-string/28164/1 "2020-06-11T09:45:50Z")

</div>

Hi all,

A silly question, I've been trying to get a custom HTTP end-point for a node working -- this has an endpoint which lists what serial ports are available (should be a familiar problem).

My endpoint code looks like this:

```javascript

    RED.httpAdmin.get(
        '/wsmodbus/serial/ports',
        RED.auth.needsPermission('serial.read'),
        function (req, res) {
            const fs = require('fs');
            const os = require('os');

            try {
                /*… etc … */
                res.json(the_list);
            } catch (err) {
                res.status(500);
                res.json([err.message]);
            }
        }
    );

```

Now, my `settings.js` has this:

```json
    adminAuth: {
        type: "credentials",
        users: [{
            username: "admin",
            password: "…",
            permissions: "*"
        }]
    },

```

This is basically what is seen in [the documentation](http://nodered.org/docs/security.html).

If I try to hit the endpoint from the UI, I get error `401: Unauthorized`. I would have thought `*` meant access all areas. Node-RED begs to differ it would seem.

[Elsewhere](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/9), I saw this written as an array. This `sed` command indeed resolved the 401 error:

```bash
sed -ie '/permissions:/ s/"\*"/["*"]/g' config/settings.js 

```

Sadly, JSON won't let me make it both an array and a string simultaneously, I have to choose one or the other. The array form is undocumented, the string form doesn't seem to work as advertised.

Which is it meant to be?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [11 June 2020 10:01 UTC](https://discourse.nodered.org/t/adminauth-users-permissions-array-or-string/28164/2 "2020-06-11T10:01:20Z")

</div>

The `permissions` value can be either a single string (`"*"`), or an array of strings (`["*"]`).

The array option isn't documented as such as we haven't really documented the ability for users to have finer grained permissions than the 'read-only' or 'full read-write (`*`) options in the docs.

I've just tested locally and it is working fine for me with either style `"*"` or `["*"]`.

---

<div class="post-metadata">

**Author:** ![Redhatter](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/redhatter/32/23748_2.png) [@Redhatter](https://discourse.nodered.org/u/Redhatter)\
**Post date:** [11 June 2020 10:54 UTC](https://discourse.nodered.org/t/adminauth-users-permissions-array-or-string/28164/3 "2020-06-11T10:54:25Z")

</div>

Ahh okay, it was just confusing for a while, the endpoint didn't seem to be operational, having reverted my change to `settings.js`, it appears to be working fine now so I'm at a loss to explain what is different.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [25 June 2020 10:54 UTC](https://discourse.nodered.org/t/adminauth-users-permissions-array-or-string/28164/4 "2020-06-25T10:54:29Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.