Loopback - Implementing custom authentication

问题

We are developing a REST service but we already have an infrastructure in place to manage users. But we want to leverage the authentication and authorization mechanism of Loopback. The requirement is to

Add a remote method and receive the user credentials
Manually verify the credentials through stored procedure call
Generate the access token through Loopback
Going forward use Loopback authorization mechanisms such as roles in the application

Should I be implementing a custom login service provider using Loopback's third party login support ? I couldn't find a very good resource on this area. Any pointers would be much appreciated.

回答1:

Please check some of the following examples to see if it fits your use case:

https://github.com/strongloop/loopback-example-access-control
https://github.com/strongloop/loopback-example-passport

回答2:

My example is using a bootscript in express but you could easily change it into a remote method.

module.exports = function(app) {
    //get User model from the express app
    var UserModel = app.models.User;

    app.post('/login', function(req, res) {

        console.log(req.body);
        //parse user credentials from request body
        const userCredentials = {
            "username": req.body.username,
            "password": req.body.password
        }

        UserModel.findOne({
            "where": {
                "username": userCredentials.username
            }
        }, function(err, user) {

            // Custom Login - Put the stored procedure call here 

            if (err) {
                //custom logger
                console.error(err);
                res.status(401).json({
                    "error": "login failed"
                });
                return;
            }

            // Create the accesstoken and return the Token
            user.createAccessToken(5000, function(err, token) {
                console.log(token)
                res.json({
                    "token": result.id,
                    "ttl": result.ttl
                });
            })
        })
    });
}

Now you can use that Token for Loopbacks authorization mechanism.

来源：https://stackoverflow.com/questions/32698115/loopback-implementing-custom-authentication

标签

node.js

loopbackjs

strongloop