Loopback - Implementing custom authentication

Question

We are developing a REST service but we already have an infrastructure in place to manage users. But we want to leverage the authentication and authorization mechanism of Loopback. The requirement is to

• Add a remote method and receive the user credentials
• Manually verify the credentials through stored procedure call
• Generate the access token through Loopback
• Going forward use Loopback authorization mechanisms such as roles in the application

Should I be implementing a custom login service provider using Loopback's third party login support ? I couldn't find a very good resource on this area. Any pointers would be much appreciated.

Answer 1

Please check some of the following examples to see if it fits your use case:

• https://github.com/strongloop/loopback-example-access-control
• https://github.com/strongloop/loopback-example-passport

Answer 2

My example is using a bootscript in express but you could easily change it into a remote method.

module.exports = function(app) {
    //get User model from the express app
    var UserModel = app.models.User;

    app.post('/login', function(req, res) {

        console.log(req.body);
        //parse user credentials from request body
        const userCredentials = {
            "username": req.body.username,
            "password": req.body.password
        }

        UserModel.findOne({
            "where": {
                "username": userCredentials.username
            }
        }, function(err, user) {

            // Custom Login - Put the stored procedure call here 

            if (err) {
                //custom logger
                console.error(err);
                res.status(401).json({
                    "error": "login failed"
                });
                return;
            }

            // Create the accesstoken and return the Token
            user.createAccessToken(5000, function(err, token) {
                console.log(token)
                res.json({
                    "token": result.id,
                    "ttl": result.ttl
                });
            })
        })
    });
}

Now you can use that Token for Loopbacks authorization mechanism.