# Oauth Node-RED editor adminAuth

**URL:** <https://discourse.nodered.org/t/oauth-node-red-editor-adminauth/68018>\
**Category:** General\
**Tags:** security\
**Created:** [21 September 2022 10:00 UTC](https://discourse.nodered.org/t/oauth-node-red-editor-adminauth/68018 "2022-09-21T10:00:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AMWN](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/amwn/32/41809_2.png) [@AMWN](https://discourse.nodered.org/u/AMWN)\
**Post date:** [21 September 2022 10:00 UTC](https://discourse.nodered.org/t/oauth-node-red-editor-adminauth/68018/1 "2022-09-21T10:00:16Z")

</div>

I have setup oAuth authentication with azure-ad. Everything works well except the part how to handle invalid users. I only allow users which have a specific group in azure ad.

I check this in de verify function.

```auto
verify: function (profile, done) {
                    if(profile._json.groups.includes('6c7ba4-529-48b-b4c-70a403ba111')) {
                        profile.username = profile._json.preferred_username;
                        done(null, profile);
                     } else {
                        done(null, false);
                    }
                }

```

How should I handle users which doesn't has the group?

- If I don't call the done function, the frontend is waiting for a response. If I do call the done function with false, it just continues to the user function.

```auto
 users: function (user) {
            if(user) {
                return Promise.resolve({ username: user, permissions: "*" }) 
            } else {
                return Promise.resolve(null)
            }
        }

```

I could check in de user function if the username is false, then resolve null. Is this case node-red backend is responding a 'Not Autorized (401)', but the frontend shows an error.

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/8/1/81ca748167f569063ad8ef533619deeed5324988.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [20 November 2022 10:00 UTC](https://discourse.nodered.org/t/oauth-node-red-editor-adminauth/68018/2 "2022-11-20T10:00:58Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.