[Bug]: R/W and R permission users error on KIP plugin call

[silvano-1961]

Feature Request

Hello,

first of all, thank you for KIP. We are currently evaluating it as part of a marine monitoring and control system and have encountered a question regarding configuration sharing between Signal K users.

Environment
Signal K Server: 2.27.0
KIP: 4.8.0
Authentication enabled
Signal K users:
BoatAdmin (Admin)
demoviewer (Read/Write or Read Only)
What we are trying to achieve

We have created a complete dashboard setup under the user BoatAdmin.

We would like a second user (demoviewer) to be able to:

Log into Signal K
Automatically load the existing KIP dashboards
Navigate between dashboards
View all data

without requiring administrative privileges.

The goal is to provide a demonstration/viewer account while keeping configuration management restricted to administrators.

What we observe

When logging in as demoviewer, KIP creates its own user configuration:

applicationData/users/demoviewer/kip/11.0.0.json

while BoatAdmin has:

applicationData/users/BoatAdmin/kip/11.0.0.json

The viewer account does not automatically see the dashboards created by BoatAdmin.

In the KIP documentation we found:

User Scope: Each user has their own private storage space.

and

Global Scope: Accessible only to users with Signal K "Admin" permissions.

This seems to imply that configuration sharing is only available through the Global Scope, which requires Admin permissions.

Additional observation

When using a non-admin user, KIP reports:

Failed to load KIP plugin configuration:
[Plugin Config Service] Authentication required

and Signal K logs show:

GET /plugins/kip 401
POST /plugins/kip/series/reconcile 401

When the same user is temporarily promoted to Admin, these issues disappear.

Questions
Is there a supported way to share an existing KIP dashboard configuration with a non-admin Signal K user?
Is there a recommended approach for creating a "viewer/demo" account that can load preconfigured dashboards but cannot modify system configuration?
Is configuration sharing between users expected to be performed only through the Global Scope?
Are there plans to support shared dashboard access for non-admin users?

Thank you for your help.

Best regards,

Silvano Ambrosini
CobrAm / BOS Project

Concepts, Ideas & Research

No response

[godind]

Hi. Thank for your interest in Signal K and KIP.

You cannot share a configuration "dynamically". You can copy a configuration from one user to another using the Global storage space.

Note that a read only user has limitations such as not being able to send data to the server (using switches and such).

There is no plan at the moment to add the ability the share a single configuration with different user or assigning different configuration access rights to different users.

1. May I ask what is the use case you are trying to acheive with the demo user?

2. Can you also share the KIP error from the console log?

3. the Signal K logs showing:

GET /plugins/kip 401
POST /plugins/kip/series/reconcile 401

Is probably because you are editing your dashboard with the read only user. If you can tell me what operation generates this error. I might be able to clear it.

[silvano-1961]

Hi David, I reproduced the issue in a clean private/incognito browser window using the read-only Signal K user demoviewer. The operation that triggers the errors is: 1. Open the BOS dashboard page that contains KIP. 2. KIP loads and connects to the Signal K server. 3. I sign in with the read-only user. 4. KIP shows the error message: Failed to load KIP plugin configuration: [Plugin Config Service] Authentication required At the same time, the browser console shows several 401 / 403 related errors. The most relevant ones I see are: [KipSeriesApiClientService] Series reconcile request failed: POST https://signalk.cobram.eu/plugins/kip/series/reconcile 401 Unauthorized GET https://signalk.cobram.eu/plugins/kip 401 Unauthorized GET https://signalk.cobram.eu/signalk/v1/applicationData/user/kip/1 401 Unauthorized There is also this warning: [Request Service] Status Code: 403 - DENIED: Authorization with R/W or Admin permission level is required to send commands. Configure Sign In credential. In the KIP status area I can see: KIP: 4.8.0 signalk-server-node 2.27.0 Connected, Readonly Internet: Available So KIP does connect as read-only, but it still tries to access plugin configuration, user application data, and series reconcile endpoints that require higher permissions. I am attaching screenshots of the console and network requests. For my use case, the read-only user does not need to edit dashboards or send switch commands. The desired behavior would simply be that a read-only/demo user can open an existing dashboard configuration without KIP showing these authentication errors. It is acceptable that editing, saving, reconciling, and command/switch actions remain unavailable for read-only users. Please let me know if you need a specific browser console export or server-side Signal K logs as well.

[godind]

Thanks for the troubleshooting. I will release a fix for this issue.

[godind]

Working on this.

[silvano-1961]

Thank you for confirming this and for looking into it. Please let me know if you need any additional information or testing from our side.