# Limited capability user

**URL:** <https://discourse.nodered.org/t/limited-capability-user/82683>\
**Category:** General\
**Tags:** security\
**Created:** [7 November 2023 12:39 UTC](https://discourse.nodered.org/t/limited-capability-user/82683 "2023-11-07T12:39:53Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [7 November 2023 12:39 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/1 "2023-11-07T12:39:53Z")

</div>

In NR v.3.1.0 is it possible to limit a specific user to use (view/execute) only a single flow?

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [7 November 2023 12:48 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/2 "2023-11-07T12:48:24Z")

</div>

Not a single flow, permissions are currently global.  
I think foundations are being laid bit by bit for that level of control.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [7 November 2023 20:40 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/4 "2023-11-07T20:40:01Z")

</div>

You can do it if you set up a node-red instance for each user. 😉

---

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [8 November 2023 07:22 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/5 "2023-11-08T07:22:21Z")

</div>

Yes, I know but it's not very convenient... 🤣

---

<div class="post-metadata">

**Author:** ![greengolfer](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/greengolfer/32/28276_2.png) [@greengolfer](https://discourse.nodered.org/u/greengolfer)\
**Post date:** [8 November 2023 08:30 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/6 "2023-11-08T08:30:54Z")

</div>

If you really need this, then having a docker container per user proxied by traefik for authentication is an option.  
It may look like a sledgehammer to kill a fly, but, that's doable.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [8 November 2023 13:20 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/7 "2023-11-08T13:20:11Z")

</div>

> [@fmarzocca](#):
>
> not very convenient

Time to brush up on your automation skills? 🙂

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [8 November 2023 13:25 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/8 "2023-11-08T13:25:39Z")

</div>

> [@TotallyInformation](#):
>
> Time to brush up on your automation skills?

Can probably automate it though 🤭

---

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [8 November 2023 14:04 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/9 "2023-11-08T14:04:34Z")

</div>

Actually, it's not for me but for a friend of mine. And I'm very lazy! 😇

---

<div class="post-metadata">

**Author:** ![fmarzocca](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fmarzocca/32/35901_2.png) [@fmarzocca](https://discourse.nodered.org/u/fmarzocca)\
**Post date:** [8 November 2023 14:10 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/10 "2023-11-08T14:10:26Z")

</div>

In the end I solved it like this.  
What he needed was to have just one flow run by another person, so I set up an `http-in` call for him, with a secret code in the url, to be detected by NR in `msg.req.params.loc`. He was happy, and I was happier.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [8 November 2023 14:19 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/11 "2023-11-08T14:19:51Z")

</div>

Ah, that was the missing info. Yes, a much simpler approach.

If you need to extend in the future, I'd recommend using a reverse proxy such as NGINX and then you can easily password protect individual URL's and even add network restrictions, allow GitHub logins and much more. Or, if doing it over the Internet, use ZeroTier or Cloudflare Zero Trust.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [7 January 2024 14:19 UTC](https://discourse.nodered.org/t/limited-capability-user/82683/12 "2024-01-07T14:19:54Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.