Hi, I am building an educational site where node-red is embedded into Drupal site(iFrame). Now I need suggestion how to securely pass user credentials from drupal to UI. I am ok with passing one and same user/pass combo to all users as long as they have logged in with drupal then they should log into Node-Red Dash automatically. Preferably users do not need see node-red login password at all. I have already setup OAUTH2 for admin logins but unfortunately it seems oauth2 is not supported for ui logins.
What do you mean by UI? Are you talking about the editor or some UI you have created using the flows in Node-RED?
For editor I have already enabled Oauth2 and it is working. See my previous post: Oauth2 with Drupal
But now I would like to have similar for UI (Yes created flows). So instead of this popping up when iFrame is opened at Drupal. I would like it to login automatically if user is logged into drupal:
Is it asking for a login because you have httpNodeAuth setup in settings.js?
If not, I think you should be able to connect to the UI without a login, though I've never tried it in an iframe or embedded in a CMS.
Turning off all security isn't what they are asking for though... they want someone logged into their Drupal based app to be preauthenticated with the UI.
@terkaa the options around securing the http routes of a flow are fairly limited.
httpNodeMiddleware setting lets you add a custom middleware function to the route handling. It's pretty low level, but could be used to validate the requests instead of using httoNodeAuth. I don't have an example to hand for that - you may find something in the forum.
Nope we do not want to turn off security. I was afraid that httpNodeMiddleware is only option. I will try to find some examples of implementing this.
I got an idea that if I run Node-red behind Apache ReverseProxy under lets say location "/nodered" And then I define Oauth2 for that location with Apache. That might work? Unfortunately Drupal Oauth2 server has bug with storing JWT access tokens so this does not work(yes tried that for couple hours yesterday). Hopefully bug gets fixed soon.
Link to bug report
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.