Research on user login authentication in node-red

Introduction

By default, the node-red editor can be operated by any user who accesses it, including modifying nodes, flow data, and redeploying flows.
This default deployment method is only suitable for running on a reliable network. Next, I will introduce how to enhance security and perform permission verification after deploying node-red on the public internet.
It mainly consists of three parts

• Enabling https permission
• Protecting the editor and admin api
• Protecting http nodes and node-red dashboard

Enabling https

By default, node-red uses http for access. If you want to configure https access, you need to configure thesettingMake some configurations in the filehttpssection in the node-red configuration file
. In the configuration file, the https configuration item can be a static JSON data or a function. The complete configuration parameters are the settings of the http module in nodejsClick the link to view the complete configuration

In this configuration item, there must be at least two items that need to be returned or configured.

• key The formatted key in PEM format, which can be of type String or Buffer
• cert The formatted Cert chain in PEM format, which can be of type String or Buffer

Example of configuration

https: {
    key: require("fs").readFileSync('privkey.pem'),
    cert: require("fs").readFileSync('cert.pem')
},

If you want to configure it as a function, remember to pass the key and cert in a promise, as follows

https: function() {
    return new Promise((resolve, reject) => {
        var key, cert;
        // Do some work to obtain valid certificates
        // ...
        resolve({
            key: key
            cert: cert
        })
    });
}

If you want to automatically refresh the certificate after configuring https without restarting node-red, node-red can also do it. This requires nodejs to be above version 11, and https must be configured as a function. Then sethttpsRefreshInterval, which is a number indicating the number of hours for automatic refresh.

Authentication for the editor and Admin API

The editor and Admin API of node-red support two types of authentication

• Use username, password, and certificate for authentication
• Use any OAuth/OpenID provider for authentication, such as Twitter or GitHub.

Authentication based on username and password can be configured only in the setting configuration file
. Below is an example of configuration

adminAuth: {
    type: "credentials",
    users: [
        {
            username: "admin",
            password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN.",
            permissions: "*"
        },
        {
            username: "george",
            password: "$2b$08$wuAqPiKJlVN27eF5qJp.RuQYuy6ZYONW7a/UWYxDTtwKFCdB8F19y",
            permissions: "read"
        }
    ]
}

. Administrators can configure multiple users. The login and permission data for these users are fixed, including the login account, password, and permissions. The password is hashed using the bcrypt algorithm tool.
To generate a hashed password, you can usenode-red admin hash-pw(after node-red 1.1.0)

. OAuth/OpenID can be used for authorization

dminAuth: {
    type:"strategy",
    strategy: {
        name: "twitter",
        label: 'Sign in with Twitter',
        icon:"fa-twitter",
        strategy: require("passport-twitter").Strategy,
        options: {
            consumerKey: TWITTER_APP_CONSUMER_KEY,
            consumerSecret: TWITTER_APP_CONSUMER_SECRET,
            callbackURL: "http://example.com/auth/strategy/callback",
            verify: function(token, tokenSecret, profile, done) {
                done(null, profile);
            }
        },
    },
    users: [
       { username: "knolleary",permissions: ["*"]}
    ]
}

. Configuration item details:
name: Policy name
label/icon: Information displayed on the login page
strategy: Required library
options: Configure based on strategy, required parameters
verify: Verification function, finally use the done function to pass the user information down

Set default user

If you want to restrict certain permissions for node-red when not logged in, you can use the method of setting a default user to achieve this
Configure a default user and set its permissions. The permissions can be full or read-only.
Here is an example

adminAuth: {
    type: "credentials",
    users: [ /* list of users */ ],
    default: {
        permissions: "read"
    }
}

In addition to the permission restrictions for * and read, administrators can also configureAdmin API
For example, to obtain information about the current flow, users will requireflow.readpermissions. If they want to update flow information, they need to useflows.writepermissions.

Custom user authentication

The user authentication methods introduced so far are hard-coded, with user data and corresponding permissions written in a fixed way. This approach is not conducive to expansion, so node-red provides another method, custom user authentication. Here are the implementation steps
Create<node-red>/user-authentication.jsWrite authorization code according to the following template

module.exports = {
   type: "credentials",
   users: function(username) {
       return new Promise(function(resolve) {
           // Do whatever work is needed to check username is a valid
           // user.
           if (valid) {
               // Resolve with the user object. It must contain
               // properties 'username' and 'permissions'
               var user = { username: "admin", permissions: "*" };
               resolve(user);
           } else {
               // Resolve with null to indicate this user does not exist
               resolve(null);
           }
       });
   },
   authenticate: function(username,password) {
       return new Promise(function(resolve) {
           // Do whatever work is needed to validate the username/password
           // combination.
           if (valid) {
               // Resolve with the user object. Equivalent to having
               // called users(username);
               var user = { username: "admin", permissions: "*" };
               resolve(user);
           } else {
               // Resolve with null to indicate the username/password pair
               // were not valid.
               resolve(null);
           }
       });
   },
   default: function() {
       return new Promise(function(resolve) {
           // Resolve with the user object for the default user.
           // If no default user exists, resolve with null.
           resolve({anonymous: true, permissions:"read"});
       });
   }
}

Finally, configure
adminAuth: require("./user-authentication")

in the adminAuth section of the setting file.

That's all for this article. This content is particularly important for those who want to fine-tune the permissions of node-red, especially when transforming it into a multi-tenant system. Thank you for watching.