# Setting - adminauth - autologin causes infinite loop if user unauthorized

**URL:** <https://discourse.nodered.org/t/setting-adminauth-autologin-causes-infinite-loop-if-user-unauthorized/81489>\
**Category:** General\
**Created:** [22 September 2023 11:45 UTC](https://discourse.nodered.org/t/setting-adminauth-autologin-causes-infinite-loop-if-user-unauthorized/81489 "2023-09-22T11:45:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![DJDev](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@DJDev](https://discourse.nodered.org/u/DJDev)\
**Post date:** [22 September 2023 11:45 UTC](https://discourse.nodered.org/t/setting-adminauth-autologin-causes-infinite-loop-if-user-unauthorized/81489/1 "2023-09-22T11:45:05Z")

</div>

Scenario: NodeRed is secured with an oidc flow by implementing the adminauth setting (type strategy). option autologin is set to true, so the user will have to log in using the configured identity provider. A user logs in and is successfully authenticated in the oidc flow itself with a user profile and token returned to the passport implementation. A validation check of the retrieved user account in NodeRed leads to the conclusion that the user account has not enough rights (for instance not the correct role). So the user is not given any permissions in NodeRed. Because of the auto login, NodeRed tries to log in over and over again with the account that returned a valid token from OIDC but does not have enough rights to log in into NodeRed, creating a loop. Is there a way\recommendation to prevent this?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [22 September 2023 11:56 UTC](https://discourse.nodered.org/t/setting-adminauth-autologin-causes-infinite-loop-if-user-unauthorized/81489/2 "2023-09-22T11:56:27Z")

</div>

Hi @DJDev

this is a known problem - although I can't immediately find the issue... it's possible it didn't get raised.

Can I trouble you to raise an issue on [GitHub - node-red/node-red: Low-code programming for event-driven applications](https://github.com/node-red/node-red) ?

---

<div class="post-metadata">

**Author:** ![DJDev](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@DJDev](https://discourse.nodered.org/u/DJDev)\
**Post date:** [22 September 2023 12:54 UTC](https://discourse.nodered.org/t/setting-adminauth-autologin-causes-infinite-loop-if-user-unauthorized/81489/3 "2023-09-22T12:54:57Z")

</div>

Hi Nick,

Thanks for the fast reply. I will raise an issue on github.

---

<div class="post-metadata">

**Author:** ![DJDev](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@DJDev](https://discourse.nodered.org/u/DJDev)\
**Post date:** [22 September 2023 13:22 UTC](https://discourse.nodered.org/t/setting-adminauth-autologin-causes-infinite-loop-if-user-unauthorized/81489/4 "2023-09-22T13:22:47Z")

</div>

See [Setting - adminauth - autologin causes infinite loop if user unauthorized · Issue #4363 · node-red/node-red · GitHub](https://github.com/node-red/node-red/issues/4363)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [21 November 2023 13:22 UTC](https://discourse.nodered.org/t/setting-adminauth-autologin-causes-infinite-loop-if-user-unauthorized/81489/5 "2023-11-21T13:22:50Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.