# Own custom OAuth/OpenID provider implementation

**URL:** https://discourse.nodered.org/t/own-custom-oauth-openid-provider-implementation/9658
**Category:** General
**Created:** [1 April 2019 13:36 UTC](https://discourse.nodered.org/t/own-custom-oauth-openid-provider-implementation/9658 "2019-04-01T13:36:18Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![zsigmondszilveszter](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zsigmondszilveszter/32/7217_2.png) [@zsigmondszilveszter](https://discourse.nodered.org/u/zsigmondszilveszter)
#### Post date: [1 April 2019 13:36 UTC](https://discourse.nodered.org/t/own-custom-oauth-openid-provider-implementation/9658/1 "2019-04-01T13:36:18Z")

</div>

Hello everyone,  
I need some help if it is possible. Here is the short description of my node-red setup. I want to implement my own custom Passport.js Strategy and use it with node-red. Note: the node-red storage engine is overridden with my own implementation. I have reached the point where I successfully take a JWT token from my own custom provider and it is stored in editor’s (browser) localStorage. The token is attached to every request as a bearer token. But then comes the problem, the editor-api doesn’t recognize as a valid access-token. I followed the route of bearer authentication and found out that at the token validation (_@node-red_/editor-api/lib/auth/strategies.js:33) there is no such token stored and therefore the token is marked as invalid. During the process the customStorage’s saveSessions method is not called at all. The question is where Twitter’s, Github’s or other provider’s access\_tokens are stored and how they are verified?  
Here is my settings.js content as well:

```auto
const customStorageModule = require("./storage_module");

module.exports = {
    httpAdminRoot:"/red/",
    httpNodeRoot: "/api",
    userDir: workingDirectory + sep + '.node-red',
    coreNodesDir: "node_repository",
    storageModule: customStorageModule,
    functionGlobalContext: {}, // enables global context
    adminAuth: require('./cloud_passport.js')({
        baseURL: "http://cloud.localhost/red/"
    })

```

And my Passport.js custom Strategy implementation (cloud\_passport.js):

```auto
const util = require("util");
const passport = require('passport-strategy');

function Strategy(arg) {
	passport.Strategy.call(this);
	this.name = arg.name;
	this._verify = arg.verify;
}
util.inherits(Strategy, passport.Strategy);

Strategy.prototype.authenticate = function (req, res) {
	var self = this;

	function verified(err, user, info) {
		if (err) {
			return self.error(err);
		}
		if (!user) {
			return self.fail(info);
		}
		self.success(user, info);
	}

	try {
		this._verify(req, verified);
	} catch (ex) {
		return self.error(ex);
	}
};
module.exports = function(opts) {
    var callbackURL = opts.baseURL+
        ((opts.baseURL[opts.baseURL.length-1] === "/")?"":"/")+
        "auth/strategy/callback";

    var adminAuth = {
        type:"strategy",
        strategy: {
            name: "Szilveszter",
            label: "Sign in with Szilveszter",
            icon:"fa-twitter",
            strategy: Strategy,
            options: {
                callbackURL: callbackURL,
                baseURL: opts.baseURL,
                name: "Szilveszter",
                verify: function (req, callback) {
                    callback(null, {
                        username: "Szilveszter",
                        permissions: ["*"],
                        tokens: {
                            accessToken: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
                        }
                    });
                }
            }
        },
        users: async arg => {
            return {
                username: arg,
                permissions: ["*"]
            }
        },
    };

```

---

<div class="post-metadata">

### Author: ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [1 April 2019 18:45 UTC](https://discourse.nodered.org/t/own-custom-oauth-openid-provider-implementation/9658/2 "2019-04-01T18:45:07Z")

</div>

> [@zsigmondszilveszter](#):
>
> The question is where Twitter’s, Github’s or other provider’s access\_tokens are stored and how they are verified?

That is not how it works.

The auth plugin verifies a user is valid and then the runtime generates one of our own tokens for the user and that is what the editor uses. We do not store any tokens generated by the auth plugin.

You should not be doing anything in the editor to attach your own bearer tokens - the editor takes care of that using its own token.