How to use fortify on multiple places for authentication

[AjithLalps]

A website has multiple users like - Admin, Registered users and Public users.
For Admin and registered users, we use different URL and both users have a different login form. maybe admin login will be at webiste.com/admin/login and user login will be website.com/login.

When using jetstream fortify is used for authentication for website.com/login.

How we can use fortify for website.com/admin/login? mainly in jetstream?

Note: In earlier versions, we can copy-paste the auth folder completely to build a new login.

[ali-alharthi]

You can achieve this by using middle-wares and one (single) users table. Show a link to admin panel when user is admin ...etc!
I recommend you to use a single table with a column indicating the user level or simply if the user is an admin (for example $table->boolean('is_admin')->default(false);).
Then, like I said use middlewares to check user's level and to enforce/validate ..etc on specific routes/methods.
For example:

<?php

namespace App\Http\Middleware;

use Closure;

class AdminMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if ($request->user() && $request->user()->is_admin) {
            return $next($request);
        }

        return redirect()
                ->route('dashboard')
                ->with('error', 'Sorry, you do not have the permission.');
    }
}

Hope it help!

[AjithLalps]

Is this possible with Fortify? since Fortify points to single controller and actions, changing middleware will affect the other user role. Also, can't use Fortify controller in another place. I don't think adding a single middleware will solve the issue. Correct me if I'm wrong.

[ali-alharthi]

@AjithLalps Of course it is! That is how laravel works - I have a project that been using this method and just replaced laravel/ui with Fortify and nothing changed at all.
Fortify, is just a package that utilizes the Auth Facade in a robust way. At the end of the day it is a package and not a core requirement so it would never change how Laravel works behind the scenes.
Final note, I recommend checking Jetstream - and see how it utilizes Fortify and adds more features to it such as teams.

[ali-alharthi]

Also, you can take advantage of blade to help with showing if a user is admin or not within blade components.
For example, I had a project where a user have a role (1,2,3,4,5 or 6 ..etc) and depending on that rule it can do somethings.
So in the AppServiceProvider I had the following:

    public function boot()
    {
        ...
        Blade::if('role', function (array $roles) {
            return Auth::check() && in_array(Auth::user()->role, $roles, true);
        });
        ...
    }

So in any blade component I could do the following:

@role([1,2])
Only users with role 1 or 2 can view this part of the component :D
@endrole

Laravel has a lot of awesome features that comes out of the box. I suggest to read the documentation more and get to see the parts of Laravel that you are missing and while you're at it check Laracasts it has a lot of helpful examples and community!.

[yob-yob]

so I know that Roles are good.. but I have another scenario..

if I'm logged in as an admin, I still want to be able to log-in as customer...

something like wordpress CMS works.. I have a login for the CMS and another login for the customer.. I should be able to login to both at the same time.. that should mean laravel would handle 2 guards at the same time..

sadly fortify does not support this.. you know, multi auth...

Fortify should have a static function that authenticates a users by guard..

public function AdminLogin(Request $request) {
 Fortify::authenticateUsingGuard($request, 'admin');
}
public function CustomerLogin(Request $request) {
 Fortify::authenticateUsingGuard($request, 'customer');
}

[ali-alharthi]

I fully understand your issue now.
Unfortunately, Fortify does not provide that feature. It was developed to be the official base/skeleton for authentication in Laravel.
Feel free to develop a package that does that or find a package that gives you this feature.

IMHO, if you're a super-admin you should be able to see everything including the customer orders, records, ...etc. Login for the customer is a thing that should be tested during the development phase. and you could always create a testing account with customer role and see if everything is good-to-go.

I will look around Github and see if I could find a package for your issue 😄

[ali-alharthi]

This package seems to offer the feature you need:

On top of that, you can use multiple authentication types, simultaneously, so you can be logged in as a user and an admin, without conflicts!

I have never tried it but you can give it a try.

[ghost]

Agreed with @yob-yob, how come the first party package doesn't support its own framework's core feature (the auth guard).

[koudera1]

https://max-eckel.dev/posts/multi-guard-authentication-with-laravel-fortify

[mustafabugra]

@AjithLalps did you find a proper solution or workaround to your question? I am looking for the exact same thing: Two different login pages inside the project. The closest one to what you have asked is with the subdomain version which @koudera1 is also shared.

[AjithLalps]

I have changed it to roles and permissions. A reference video from Laravel Daily https://www.youtube.com/watch?v=NiQSNjWKLfU

[oguzydz]

How did you handle same user with different email in the different tables?

[mustafabugra]

@oguzydz I am not entirely sure how I solved because It has been a while. But I think I changed my structure to manage all from same login page. Then you can redirect based on the user role.