From bea43f211ccb91186ce9205a5cfadf5fcd1b6d94 Mon Sep 17 00:00:00 2001 From: ShahanaFarooqui Date: Wed, 25 Mar 2026 20:27:25 -0700 Subject: [PATCH] Add Disable Authentication option in the backend --- backend/controllers/shared/authenticate.js | 10 +++++++++- backend/models/config.model.js | 3 ++- backend/utils/config.js | 11 ++++++++++- server/controllers/shared/authenticate.ts | 7 ++++++- server/models/config.model.ts | 1 + server/utils/config.ts | 10 +++++++++- 6 files changed, 37 insertions(+), 5 deletions(-) diff --git a/backend/controllers/shared/authenticate.js b/backend/controllers/shared/authenticate.js index 7ffa4bb1..62b96ec3 100644 --- a/backend/controllers/shared/authenticate.js +++ b/backend/controllers/shared/authenticate.js @@ -48,7 +48,15 @@ export const verifyToken = (twoFAToken) => !!(common.appConfig.secret2FA && comm export const authenticateUser = (req, res, next) => { const { authenticateWith, authenticationValue, twoFAToken } = req.body; logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Authenticate', msg: 'Authenticating User..' }); - if (+common.appConfig.SSO.rtlSSO) { + if (!!common.appConfig.disableAuth) { + if (!req.session.selectedNode) { + req.session.selectedNode = common.selectedNode; + } + const token = jwt.sign({ user: 'AUTH_DISABLED_USER' }, common.secret_key); + logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Authenticate', msg: 'User Disabled Authentication' }); + res.status(200).json({ token: token }); + } + else if (+common.appConfig.SSO.rtlSSO) { if (authenticateWith === 'JWT' && jwt.verify(authenticationValue, common.secret_key)) { logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Authenticate', msg: 'User Authenticated' }); res.status(406).json({ message: 'SSO Authentication Error', error: 'Login with Password is not allowed with SSO.' }); diff --git a/backend/models/config.model.js b/backend/models/config.model.js index 9a66e2d4..4c2b14c9 100644 --- a/backend/models/config.model.js +++ b/backend/models/config.model.js @@ -40,11 +40,12 @@ export class Authentication { } } export class ApplicationConfig { - constructor(defaultNodeIndex, selectedNodeIndex, dbDirectoryPath, rtlConfFilePath, rtlPass, multiPass, multiPassHashed, allowPasswordUpdate, enable2FA, secret2FA, SSO, nodes) { + constructor(defaultNodeIndex, selectedNodeIndex, dbDirectoryPath, rtlConfFilePath, disableAuth, rtlPass, multiPass, multiPassHashed, allowPasswordUpdate, enable2FA, secret2FA, SSO, nodes) { this.defaultNodeIndex = defaultNodeIndex; this.selectedNodeIndex = selectedNodeIndex; this.dbDirectoryPath = dbDirectoryPath; this.rtlConfFilePath = rtlConfFilePath; + this.disableAuth = disableAuth; this.rtlPass = rtlPass; this.multiPass = multiPass; this.multiPassHashed = multiPassHashed; diff --git a/backend/utils/config.js b/backend/utils/config.js index 60f3d0d9..b001d38f 100644 --- a/backend/utils/config.js +++ b/backend/utils/config.js @@ -118,9 +118,18 @@ export class ConfigService { this.validateNodeConfig = (config) => { config.allowPasswordUpdate = true; if ((process?.env?.RTL_SSO && +process?.env?.RTL_SSO === 0) || (typeof process?.env?.RTL_SSO === 'undefined' && +config.SSO.rtlSSO === 0)) { - if (process?.env?.APP_PASSWORD && process?.env?.APP_PASSWORD.trim() !== '') { + if (!!process?.env?.DISABLE_AUTH || !!config.disableAuth) { + config.allowPasswordUpdate = false; + config.enable2FA = false; + this.logger.log({ selectedNode: this.common.selectedNode, level: 'WARN', fileName: 'Config', msg: 'Authentication is Disabled via environment or config' }); + if (process?.env?.APP_PASSWORD && process?.env?.APP_PASSWORD.trim() !== '') { + this.errMsg = this.errMsg + '\nRTL Password cannot be set with disabled authentication. Please remove disableAuth option or password.'; + } + } + else if (process?.env?.APP_PASSWORD && process?.env?.APP_PASSWORD.trim() !== '') { config.rtlPass = this.hash.update(process?.env?.APP_PASSWORD).digest('hex'); config.allowPasswordUpdate = false; + this.logger.log({ selectedNode: this.common.selectedNode, level: 'WARN', fileName: 'Config', msg: 'Passing APP_PASSWORD via environment is suggested for standalone RTL application' }); } else if (config.multiPassHashed && config.multiPassHashed !== '') { config.rtlPass = config.multiPassHashed; diff --git a/server/controllers/shared/authenticate.ts b/server/controllers/shared/authenticate.ts index 21ca9615..252f6b88 100644 --- a/server/controllers/shared/authenticate.ts +++ b/server/controllers/shared/authenticate.ts @@ -52,7 +52,12 @@ export const verifyToken = (twoFAToken) => !!(common.appConfig.secret2FA && comm export const authenticateUser = (req, res, next) => { const { authenticateWith, authenticationValue, twoFAToken } = req.body; logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Authenticate', msg: 'Authenticating User..' }); - if (+common.appConfig.SSO.rtlSSO) { + if (!!common.appConfig.disableAuth) { + if (!req.session.selectedNode) { req.session.selectedNode = common.selectedNode; } + const token = jwt.sign({ user: 'AUTH_DISABLED_USER' }, common.secret_key); + logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Authenticate', msg: 'User Disabled Authentication' }); + res.status(200).json({ token: token }); + } else if (+common.appConfig.SSO.rtlSSO) { if (authenticateWith === 'JWT' && jwt.verify(authenticationValue, common.secret_key)) { logger.log({ selectedNode: req.session.selectedNode, level: 'INFO', fileName: 'Authenticate', msg: 'User Authenticated' }); res.status(406).json({ message: 'SSO Authentication Error', error: 'Login with Password is not allowed with SSO.' }); diff --git a/server/models/config.model.ts b/server/models/config.model.ts index c9761292..d6ee76cf 100644 --- a/server/models/config.model.ts +++ b/server/models/config.model.ts @@ -55,6 +55,7 @@ export class ApplicationConfig { public selectedNodeIndex: number, public dbDirectoryPath?: string, public rtlConfFilePath?: string, + public disableAuth?: boolean, public rtlPass?: string, public multiPass?: string, public multiPassHashed?: string, diff --git a/server/utils/config.ts b/server/utils/config.ts index 36456dfe..e0d101ce 100644 --- a/server/utils/config.ts +++ b/server/utils/config.ts @@ -126,9 +126,17 @@ export class ConfigService { private validateNodeConfig = (config) => { config.allowPasswordUpdate = true; if ((process?.env?.RTL_SSO && +process?.env?.RTL_SSO === 0) || (typeof process?.env?.RTL_SSO === 'undefined' && +config.SSO.rtlSSO === 0)) { - if (process?.env?.APP_PASSWORD && process?.env?.APP_PASSWORD.trim() !== '') { + if (!!process?.env?.DISABLE_AUTH || !!config.disableAuth) { + config.allowPasswordUpdate = false; + config.enable2FA = false; + this.logger.log({ selectedNode: this.common.selectedNode, level: 'WARN', fileName: 'Config', msg: 'Authentication is Disabled via environment or config' }); + if (process?.env?.APP_PASSWORD && process?.env?.APP_PASSWORD.trim() !== '') { + this.errMsg = this.errMsg + '\nRTL Password cannot be set with disabled authentication. Please remove disableAuth option or password.'; + } + } else if (process?.env?.APP_PASSWORD && process?.env?.APP_PASSWORD.trim() !== '') { config.rtlPass = this.hash.update(process?.env?.APP_PASSWORD).digest('hex'); config.allowPasswordUpdate = false; + this.logger.log({ selectedNode: this.common.selectedNode, level: 'WARN', fileName: 'Config', msg: 'Passing APP_PASSWORD via environment is suggested for standalone RTL application' }); } else if (config.multiPassHashed && config.multiPassHashed !== '') { config.rtlPass = config.multiPassHashed; } else if (config.multiPass && config.multiPass !== '') {