# Cannot use Azure AD Authentication

**URL:** <https://discourse.nodered.org/t/cannot-use-azure-ad-authentication/69894>\
**Category:** General\
**Tags:** security, microsoft-azure\
**Created:** [1 November 2022 13:40 UTC](https://discourse.nodered.org/t/cannot-use-azure-ad-authentication/69894 "2022-11-01T13:40:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![taffarel55](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/taffarel55/32/70057_2.png) [@taffarel55](https://discourse.nodered.org/u/taffarel55)\
**Post date:** [1 November 2022 13:40 UTC](https://discourse.nodered.org/t/cannot-use-azure-ad-authentication/69894/1 "2022-11-01T13:40:23Z")

</div>

Hello guys! I'm trying to put authentication through azure as shown here in the documentation:

`nodered.org/docs/user-guide/runtime/securing-node-red#oauthopenid-based-authentication`

Based on these examples:

- [Azure AD authentication example](https://discourse.nodered.org/t/azure-ad-authentication-example/40937)
- [Cannot POST /auth/strategy/callback](https://discourse.nodered.org/t/cannot-post-auth-strategy-callback/68886)

My `adminAuth` object is shown below:

```auto
  adminAuth: {
    type: "strategy",
    strategy: {
      name: "azuread-openidconnect",
      label: "Sign in with Azure AD",
      icon: "fa-windows",
      strategy: require("passport-azure-ad").OIDCStrategy,
      options: {
        identityMetadata: `https://login.microsoftonline.com/${process.env.MICROSOFT_AUTH_TENANT_ID}/v2.0/.well-known/openid-configuration`,
        clientID: process.env.MICROSOFT_AUTH_CLIENT_ID,
        clientSecret: process.env.MICROSOFT_AUTH_CLIENT_SECRET,
        responseType: "code",
        responseMode: "query",
        redirectUrl: "https://localhost:1880/auth/strategy/callback",
        allowHttpForRedirectUrl: true,
        issuer: `https://login.microsoftonline.com/${process.env.MICROSOFT_AUTH_TENANT_ID}/v2.0`,
        scope: ["openid", "profile"],
        verify: function (token, tokenSecret, profile, done) {
          profile.username = profile.displayName; // use display name as username
          done(null, profile);
        },
      },
    },
    users: function (user) {
      return Promise.resolve({ username: user, permissions: "*" });
    },
  },

```

I'm trying to create a custom Docker image that uses this settings file, when I start node-red I get the following terminal output:

```auto
nodered-custom | 
nodered-custom | > node-red-custom@0.0.1 start /usr/src/node-red
nodered-custom | > node $NODE_OPTIONS node_modules/node-red/red.js $FLOWS --userDir=/data
nodered-custom | 
nodered-custom | Error loading settings file: /data/settings.js
nodered-custom | 
nodered-custom | ┌───────────────────────────────────────────────────────────────┐
nodered-custom | │ npm update check failed │
nodered-custom | │ Try running with sudo or get access │
nodered-custom | │ to the local update config store via │
nodered-custom | │ sudo chown -R $USER:$(id -gn $USER) /usr/src/node-red/.config │
nodered-custom | └───────────────────────────────────────────────────────────────┘
nodered-dblab exited with code 0

```

When I use a configuration file as shown below:

```auto
adminAuth: require("./user-authentication"),

```

And following the example of the documentation, it works

`nodered.org/docs/user-guide/runtime/securing-node-red#custom-user-authentication`

It also works when I use an username and password based authentication

`nodered.org/docs/user-guide/runtime/securing-node-red#usernamepassword-based-authentication`

Using the twitter example found in docs, it doesn't work and I get the same errors bellow

```auto
adminAuth: {
    type:"strategy",
    strategy: {
        name: "twitter",
        label: 'Sign in with Twitter',
        icon:"fa-twitter",
        strategy: require("passport-twitter").Strategy,
        options: {
            consumerKey: TWITTER_APP_CONSUMER_KEY,
            consumerSecret: TWITTER_APP_CONSUMER_SECRET,
            callbackURL: "http://example.com/auth/strategy/callback",
            verify: function(token, tokenSecret, profile, done) {
                done(null, profile);
            }
        },
    },
    users: [
       { username: "knolleary",permissions: ["*"]}
    ]
}

```

Can anyone help me try to solve this problem to correctly configure authentication?

---

<div class="post-metadata">

**Author:** ![sg26565](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/sg26565/32/67419_2.png) [@sg26565](https://discourse.nodered.org/u/sg26565)\
**Post date:** [7 November 2022 18:57 UTC](https://discourse.nodered.org/t/cannot-use-azure-ad-authentication/69894/2 "2022-11-07T18:57:56Z")

</div>

The error message doesn't seem to be directly related to the Azure AD authentication. Instead, there may be something wrong with the base node.js / npm installation (permission problem?). Can you install any other external module?

It looks like you are using a custom container image. Have you tried with the original one? How do you get the external dependencies installed? I'm using an init container on Kubernetes.

---

<div class="post-metadata">

**Author:** ![taffarel55](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/taffarel55/32/70057_2.png) [@taffarel55](https://discourse.nodered.org/u/taffarel55)\
**Post date:** [8 November 2022 14:35 UTC](https://discourse.nodered.org/t/cannot-use-azure-ad-authentication/69894/3 "2022-11-08T14:35:45Z")

</div>

> It looks like you are using a custom container image:

Yeah, I'm using a custom container image, but this image is based on an official image. External dependencies are being declared in package.json and installed on Dockerfile after using an official image, I copy also some files like `settings.js`, `flows.js`... and I want to use them to build an image with my preferences.

This is my dependences in `package.json`:

```auto
"dependencies": {
    "node-red": "2.2.0",
    "node-red-contrib-influxdb": "0.6.1",
    "node-red-contrib-telegrambot": "11.6.0",
    "node-red-dashboard": "3.2.0",
    "passport-azure-ad": "3.0.8"
  },

```

And I use `passaport-azure-ad` in `adminAuth` in `settings.js`:

```auto
  adminAuth: {
    type: "strategy",
    strategy: {
      name: "azuread-openidconnect",
      label: "Sign in with Azure AD",
      icon: "fa-windows",
      strategy: require("passport-azure-ad").OIDCStrategy,
      options: {
        identityMetadata: `https://login.microsoftonline.com/${process.env.MICROSOFT_AUTH_TENANT_ID}/v2.0/.well-known/openid-configuration`,
        clientID: process.env.MICROSOFT_AUTH_CLIENT_ID,
        clientSecret: process.env.MICROSOFT_AUTH_CLIENT_SECRET,
        responseType: "code",
        responseMode: "query",
        redirectUrl: "https://localhost:1880/auth/strategy/callback",
        allowHttpForRedirectUrl: true,
        issuer: `https://login.microsoftonline.com/${process.env.MICROSOFT_AUTH_TENANT_ID}/v2.0`,
        scope: ["openid", "profile"],
        verify: function (token, tokenSecret, profile, done) {
          profile.username = profile.displayName; // use display name as username
          done(null, profile);
        },
      },
    },
    users: function (user) {
      return Promise.resolve({ username: user, permissions: "*" });
    },
  },

```

I don't know if this is the right way to install this dependency, I made this way cause when I use a hash based auth, I can start the application and see the blocks loaded.

```json
...

adminAuth: require("./user-authentication"),

...

```

* * *

`user-authentication.js`:

```auto
module.exports = {
  type: "credentials",
  users: function (username) {
    return new Promise(function (resolve) {
      if (username) {
        const user = { username, permissions: "*" };
        resolve(user);
      } else {
        resolve(null);
      }
    });
  },
  authenticate: function (username, password) {
    return new Promise(function (resolve) {
      const teste = username === "admin" && password === "pass";

      if (teste) {
        console.info("Authenticated!");
        
        var user = { username: "admin", permissions: "*" };
        resolve(user);
      } else {
        resolve(null);
      }
    });
  },
  default: function () {
    return new Promise(function (resolve) {
      resolve(null);
    });
  },
};

```

So I can install the dependencies as shown in image below, I don't know if to install `passport-azure-ad` it would be like this.

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/3/7/37c141d5ab680ffb119ce7acf3b34a8f6727831d.png)

When I attach shell on docker image above I can see `passport-azure-ad` installed:

```auto
~/node_modules/passport-azure-ad $ ls
CHANGELOG.md README.md contributing.md package.json
Gruntfile.js RELEASES.md lib test
LICENSE SECURITY-NOTICE.MD node_modules typings

```

I used your config in `adminAuth` but I think we did the process in different ways 😃

Thank you for your attention and I am available to answer any questions you may have.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [7 January 2023 14:36 UTC](https://discourse.nodered.org/t/cannot-use-azure-ad-authentication/69894/4 "2023-01-07T14:36:39Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.