# Broke adminAuth credentialing after changing hash in settings.js

**URL:** <https://discourse.nodered.org/t/broke-adminauth-credentialing-after-changing-hash-in-settings-js/10753>\
**Category:** General\
**Created:** [2 May 2019 19:32 UTC](https://discourse.nodered.org/t/broke-adminauth-credentialing-after-changing-hash-in-settings-js/10753 "2019-05-02T19:32:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicholas](https://avatars.discourse-cdn.com/v4/letter/n/4da419/32.png) [@nicholas](https://discourse.nodered.org/u/nicholas)\
**Post date:** [2 May 2019 19:32 UTC](https://discourse.nodered.org/t/broke-adminauth-credentialing-after-changing-hash-in-settings-js/10753/1 "2019-05-02T19:32:33Z")

</div>

Hey guys!

I needed to change the admin login credentials on our local Node-RED server for security reasons.  
I viewed [https://nodered.org/docs/security](https://nodered.org/docs/security) and followed the instructions for generating a new pass hash and updating settings.js with that new hash.

However, it didn't work and we can no longer log in. I tried changing the hash back to the original one, but that also didn't work.

For reference, the installation was done as root and the path to the edited settings.js is :  
/root/.node-red/settings.js

Any help will be massively appreciated!

-nicholas

edit : also for reference : the adminAuth section of settings.js under the normal admin user account [~/.node-red/settings.js] is commented out and editing it had / has no effect, which is the reason we looked in /root

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [2 May 2019 19:39 UTC](https://discourse.nodered.org/t/broke-adminauth-credentialing-after-changing-hash-in-settings-js/10753/2 "2019-05-02T19:39:36Z")

</div>

Check to make sure you didn’t forget a closing } or added an extra one

---

<div class="post-metadata">

**Author:** ![nicholas](https://avatars.discourse-cdn.com/v4/letter/n/4da419/32.png) [@nicholas](https://discourse.nodered.org/u/nicholas)\
**Post date:** [2 May 2019 19:43 UTC](https://discourse.nodered.org/t/broke-adminauth-credentialing-after-changing-hash-in-settings-js/10753/3 "2019-05-02T19:43:29Z")

</div>

Thanks for the rapid reply! It doesn't look to me like any brackets are out of place, but my experience level is low -- here's the whole [broken] object for reference, copied from the /root/.node-red/settings.js file [hash redacted]:

adminAuth: {  
type: "credentials",  
users: [{  
username: "admin",  
password: "this\_is\_the\_hash",  
permissions: "\*"  
}]  
},

---

<div class="post-metadata">

**Author:** ![nicholas](https://avatars.discourse-cdn.com/v4/letter/n/4da419/32.png) [@nicholas](https://discourse.nodered.org/u/nicholas)\
**Post date:** [2 May 2019 20:08 UTC](https://discourse.nodered.org/t/broke-adminauth-credentialing-after-changing-hash-in-settings-js/10753/4 "2019-05-02T20:08:30Z")

</div>

Update! My boss figured out that a _restart of node-red_ is required for the auth update to take effect, which is not mentioned in the docs.

Auth is working now. Thanks!

p.s. friendly suggestion to maintainers if y'all see this : it'd be helpful to add the restart requirement info to [https://nodered.org/docs/security](https://nodered.org/docs/security)