# Can users be set for authentication without passwords in the \`users\` array?

**URL:** <https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982>\
**Category:** General\
**Created:** [13 October 2022 12:34 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982 "2022-10-13T12:34:18Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shan](https://avatars.discourse-cdn.com/v4/letter/s/7ab992/32.png) [@Shan](https://discourse.nodered.org/u/Shan)\
**Post date:** [13 October 2022 12:34 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982/1 "2022-10-13T12:34:18Z")

</div>

According to certain examples in the [Securing Node-RED : Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red) guide there are mentions of users within the `users` array that do not seem to have a password. Is this a typo or does the Auth Engine allow users with only permissions?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [13 October 2022 12:46 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982/2 "2022-10-13T12:46:50Z")

</div>

The only example of that I can see is in the context of the Twitter OAuth example. In that instance, users login via Twitter, so no password is required. The `users` array is used to then identify what permissions a logged in user has.

---

<div class="post-metadata">

**Author:** ![Shan](https://avatars.discourse-cdn.com/v4/letter/s/7ab992/32.png) [@Shan](https://discourse.nodered.org/u/Shan)\
**Post date:** [13 October 2022 12:49 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982/3 "2022-10-13T12:49:34Z")

</div>

Okay Thanks. Would that same example be able to work with Basic Authentication from an external proxy?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [13 October 2022 12:52 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982/4 "2022-10-13T12:52:06Z")

</div>

> [@Shan](#):
>
> Would that same example be able to work with Basic Authentication from an external proxy?

Do you mean you want to do authentication entirely in the proxy and then somehow tell Node-RED about who is logged in?

You would need to pass some identifying token from the proxy to Node-RED so it knows who the user is. [Securing Node-RED : Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#custom-authentication-tokens) describes how that might work.

But I cannot say I've ever configured it in quite that way.

---

<div class="post-metadata">

**Author:** ![Shan](https://avatars.discourse-cdn.com/v4/letter/s/7ab992/32.png) [@Shan](https://discourse.nodered.org/u/Shan)\
**Post date:** [13 October 2022 12:56 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982/5 "2022-10-13T12:56:28Z")

</div>

I have been doing some trials on creating a middleware that can read HTTP Headers either `Authorization: Basic <base64encode>` or using a custom header `X-WebAuth-User: <username>` but I fall short when it comes to setting the `users` array.

This is because `users` array, albeit set via a Middleware will still redirect me to the login page and since I do not have a password set (reverse proxy only forwards the authenticated user) I cannot log the respected user in.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [13 October 2022 13:01 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982/6 "2022-10-13T13:01:14Z")

</div>

The link I pointed you at doesn't involve middleware at all.

If you are able to configure the proxy to add a custom header that identifies the user, then you can use the `tokens` and `tokenHeader` properties of `adminAuth` to read that header and return the appropriate user object for it.

---

<div class="post-metadata">

**Author:** ![Shan](https://avatars.discourse-cdn.com/v4/letter/s/7ab992/32.png) [@Shan](https://discourse.nodered.org/u/Shan)\
**Post date:** [13 October 2022 13:17 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982/7 "2022-10-13T13:17:47Z")

</div>

Ah! Fantastic ! I was _over-engineering_ the solution.

I have been able to setup the following token based middleware:

## `user-authentication.js`

```auto
module.exports = {
  type: "credentials",
  default: function() {
    return new Promise(function(resolve){
      resolve(null);
    });
  },
  tokens: function(token) {
    return new Promise(function(resolve, reject) {
      const username = token;
      var user = {username: username, permissions: ""};
      if (username == "admin") {
        user['permissions'] = "*";
      } else {
        user['permissions'] = "read";
      }
      resolve(user);
    });
  },
  tokenHeader: 'X-WebAuth-User'
};

```

## `settings.js`

```auto
adminAuth: require('./user-authentication'),

```

And things seem to be working, I am not sure at this point where I would need to use the `users` but I think I won't.

## Edit

~~This won't work because the editor will not let me deploy flows~~ 🎊 IT WORKS!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [27 October 2022 13:18 UTC](https://discourse.nodered.org/t/can-users-be-set-for-authentication-without-passwords-in-the-users-array/68982/8 "2022-10-27T13:18:28Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.