# Custom user authentication help

**URL:** <https://discourse.nodered.org/t/custom-user-authentication-help/40967>\
**Category:** General\
**Created:** [14 February 2021 12:12 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967 "2021-02-14T12:12:25Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![mac5562](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mac5562/32/34943_2.png) [@mac5562](https://discourse.nodered.org/u/mac5562)\
**Post date:** [14 February 2021 12:12 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/1 "2021-02-14T12:12:25Z")

</div>

Hi !

Is there anyone who knows, how it can be use the custom user authentication? I tried with the example (with little modification of course) but it not works. Here is my custom js:

```auto
module.exports = {
    type: "credentials",
    authenticate: function(username,password) {
        return new Promise(function(resolve) {
            var ok=false;
            if(username=="Admin"&&password=="destiny5562"){
                ok=true;
            }
            else{
                ok=false;
            }
            if (ok==true) {
                // Resolve with the user object. Equivalent to having
                // called users(username);
                var user = { username: "admin", permissions: "*" };
                resolve(user);
            } else {
                // Resolve with null to indicate the username/password pair
                // were not valid.
                resolve(null);
            }
        }); 
    },
 }

```

And in my settings.js the only thing i do that, just enabled the adminAuth:

```auto
adminAuth: require("./user-authentication"),

```

When try to log in, browser dev console throw this when i use good username and password

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/4/f/4f51045fa7d05b4bdd43280ca595c947b1aea027.png)  
But if i use the wrong username password combo, i got this:  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/0/9/09a66d767bf1f6afa792f7293c14179e23f6c06b.png)

So in a some way it works it can idetify good password username combo, but still didn't allow the let me enter the flow editor.

Do i miss something in the custom.js or the setting.js? Maybe form both missing something.

Thank you for your help in advance !

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [14 February 2021 13:01 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/3 "2021-02-14T13:01:23Z")

</div>

Did you implement the other parts ( `users` and `default`) according to [this](https://nodered.org/docs/user-guide/runtime/securing-node-red#custom-user-authentication)

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [14 February 2021 13:01 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/4 "2021-02-14T13:01:38Z")

</div>

The explanation of how to do what you are trying is here: [Securing Node-RED : Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#custom-user-authentication)

You appear to be missing the `users` function.

---

<div class="post-metadata">

**Author:** ![mac5562](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mac5562/32/34943_2.png) [@mac5562](https://discourse.nodered.org/u/mac5562)\
**Post date:** [14 February 2021 18:19 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/5 "2021-02-14T18:19:12Z")

</div>

@Steve-Mcl @TotallyInformation I tried, what you suggested me and it's worked. So for that, i tried to make a more complicated custom auth. What i want the achive is a custom auth which working with mysql. Here is look like now:

```auto
var mysql = require('mysql');
var con = mysql.createConnection({
host: "localhost",
user: "root",
password: "",
database: "smh"
});

module.exports = {
    type: "credentials",
    users: function(username) {
        return new Promise(function(resolve) {
            con.connect(function(err) {
                con.query("SELECT * FROM users WHERE username ='"+username+"'", function (err, result, fields) {
                  if (err) throw err;
            if (result.length!=0) {
                // Resolve with the user object. It must contain
                // properties 'username' and 'permissions'
                var user = {username: result[0].username, permissions: result[0].permission};
                resolve(user);
            } else {
                // Resolve with null to indicate this user does not exist
                resolve(null);
            }
             });
            });    
        });
    },
    authenticate: function(username,password) {
        return new Promise(function(resolve) {
            con.connect(function(err) {
                con.query("SELECT * FROM users WHERE username ='"+username+"' AND password='"+password+"'", function (err, result, fields) {
                if (err) throw err;
           
                if (result.length!=0) {
                // Resolve with the user object. Equivalent to having
                // called users(username);
                     var user = { username:result[0].username, permissions: result[0].permissions};
                    resolve(user);
                } else {
                // Resolve with null to indicate the username/password pair
                // were not valid.
                    resolve(null);
                }
            });
          });    
        });
    },
    default: function() {
        return new Promise(function(resolve) {
            // Resolve with the user object for the default user.
            // If no default user exists, resolve with null.
            resolve({anonymous: true, permissions:"read"});
        });
    }
  }   

```

The problem with that code is basicly the same with the that one that i posted. If i pass the good username and password it didn't allow me the enter i got 401 error, but if i pass a wrong one 403 error. So the situation is the same at was before.

Anyone have idea what's wrong now?

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [14 February 2021 19:24 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/6 "2021-02-14T19:24:32Z")

</div>

Are you running node-red in a debugging environment like vscode? You could put break points in the code & see if your query is working as expected.

Alternatively, litter your code with console logs.

---

<div class="post-metadata">

**Author:** ![mac5562](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mac5562/32/34943_2.png) [@mac5562](https://discourse.nodered.org/u/mac5562)\
**Post date:** [14 February 2021 19:26 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/7 "2021-02-14T19:26:21Z")

</div>

No, but i trying that.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [14 February 2021 20:55 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/8 "2021-02-14T20:55:24Z")

</div>

Also put in some console.log statements before your resolves to see if you are actually getting the data you think you are.

---

<div class="post-metadata">

**Author:** ![mac5562](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mac5562/32/34943_2.png) [@mac5562](https://discourse.nodered.org/u/mac5562)\
**Post date:** [22 February 2021 00:39 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/9 "2021-02-22T00:39:34Z")

</div>

It's been a week since i posted, but i found it the solution. Problem was a mistyping of the permission field name. Anyway thank you for your help

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [8 March 2021 00:40 UTC](https://discourse.nodered.org/t/custom-user-authentication-help/40967/10 "2021-03-08T00:40:30Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.