# Azure AD authentication example

**URL:** <https://discourse.nodered.org/t/azure-ad-authentication-example/40937>\
**Category:** General\
**Tags:** security\
**Created:** [13 February 2021 16:51 UTC](https://discourse.nodered.org/t/azure-ad-authentication-example/40937 "2021-02-13T16:51:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![cvb941](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cvb941/32/23722_2.png) [@cvb941](https://discourse.nodered.org/u/cvb941)\
**Post date:** [13 February 2021 16:51 UTC](https://discourse.nodered.org/t/azure-ad-authentication-example/40937/1 "2021-02-13T16:51:17Z")

</div>

Hello everyone. Today, I wanted to set-up external authentication to my Node-RED instance editor, using the Azure Active Directory of our company. I could not find any guide on this specific task, so after searching around and with a little bit of fiddling I got the integration working. I would like to share the configuration here, so if anyone would like to do the same it could be helpful for them.

As described by the [official guide for external security](https://nodered.org/docs/user-guide/runtime/securing-node-red#oauthopenid-based-authentication), Node-RED can use any Passport.js authentication plugin. There are multiple of the for Active Directory, I used this one named [passport-azure-ad](http://www.passportjs.org/packages/passport-azure-ad/). It exposes many options, the ones in the code below worked for me, but you may need to change them according to the documentation I linked.

Here is the working config, don't forget to replace your correct information where needed:

```auto
adminAuth: {
        type: "strategy",
        strategy: {
            name: "azuread-openidconnect",
            label: 'Sign in with Azure',
            icon: "fa-windows",
            strategy: require("passport-azure-ad").OIDCStrategy,
            options: {
                identityMetadata: "https://login.microsoftonline.com/###YOUR-TENANT-GUID###/v2.0/.well-known/openid-configuration",
                clientID: "###YOUR-APP-CLIENT-ID###",
                clientSecret: "###YOUR-APP-CLIENT-SECRET###",
                responseType: "code",
                responseMode: "query",
                redirectUrl: "http://localhost:1880/auth/strategy/callback",
                allowHttpForRedirectUrl: true,
                scope: ['email', 'profile'],
                verify: function (profile, done) {
                    profile.username = profile._json.preferred_username;
                    done(null, profile);
                }
            },
        },
        users: function (user) {
            return Promise.resolve({ username: user, permissions: "*" });
        }
    },

```

You need to register an Application in your Azure portal, link at aka.ms/appregistrations. You then use the clientID and clientSecret from there.

The function in the "users" field lets every user in the organization log in to the editor.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [14 April 2021 16:51 UTC](https://discourse.nodered.org/t/azure-ad-authentication-example/40937/2 "2021-04-14T16:51:43Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.