Roadmap: Extensible Authentication Strategies

[denolfe]

Description

Support other Passport.js authentication strategies

Implementation Detail

Allow passthrough of other supported Passport.js authentication strategies

Potential Breaking Changes

None

Effort

Medium

[alexbechmann]

hi @denolfe

We really need this feature :)

We would like to authenticate with active directory, and then create and log a user in depending on ad group memberships.

[denolfe]

Noted @alexbechmann, thanks for the feedback!

[alexbechmann]

@denolfe As a potentially easy first step, if we have the ability to:

• Add an additional button to the login screen
• Programmatically login a user on the server (without a password, payload.login({}) requires password)
• Create/update user doc on the server

Then we will be able to add our own login logic & callbacks.

How doable is this?

[denolfe]

@alexbechmann This feature would encompass bullet 2.

For bullet 1, depending on what you're trying to do, you could probably add something like a checkbox or radio button group to the User's collection and do logic off of that.

I'd expect bullet 3 is doable with a CollectionBeforeLoginHook and/or CollectionAfterLoginHook.

[alexbechmann]

@denolfe

bullet 1 - Yeah I agree that would be doable, good suggestion.

bullet 3 - As long as we can create/update a user with the payload SDK without a password, I see no issue here.

So yeah, it seems the only thing we need is bullet 2 for this to be possible.

[alexbechmann]

Hi @denolfe,

I was able to get a crude version of what I was trying to do working by:

• Creating a custom Logo component with a our Logo & button underneath that redirects to /login :)
• Use my own passport middleware to redirect to AD
• Doing something like this in an express callback route:

import passport, { AuthenticateOptions } from 'passport';
import jwt from 'jsonwebtoken';
import getCookieExpiration from 'payload/dist/utilities/getCookieExpiration';
import payload from 'payload';

// Code inside /callback route in express:
const expiresInSeconds = 99999999;

// Omitted code to query Microsoft Graph API for group memberships & create or find existing payload user if user has correct permissions.
const fieldsToSign = {
  email: user.email,
  id: user.id,
  collection: users.slug
};

const token = jwt.sign(fieldsToSign, payload.secret, {
  expiresIn: expiresInSeconds
});

const cookieOptions: CookieOptions = {
  path: '/',
  httpOnly: true,
  expires: getCookieExpiration(expiresInSeconds),
  secure: false,
  sameSite: 'lax',
  domain: undefined
};

res.cookie(`${payload.config.cookiePrefix}-token`, token, cookieOptions);
res.redirect('/admin');

So it's possible, but could definitely be a lot tidier if we had a function to set cookie & a nicer to way to add views to login screen :)

[denolfe]

Released in v0.19.2

[DanRibbens]

Extra documentation is still needed on this, coming soon.

[wojciechkrol]

Hello @DanRibbens,

This is really great feature.

Do you consider extending documentation with examples like "Google sign in” with code snippets on how to do it and how it works under the hood?

[lucianogreiner]

That would be super helpful to have the possibility to add custom passport strategies. We are using a work around to support a Web3 login right now.
Not sure if you thought about that too, but one thing that is bad IMO is having the password field as mandatory. This is not desirable in some strategies and we'd have to store something random there just to met the requirement, which is not ideal.

[lucianogreiner]

Looks like you did. I just saw that on a separated thread. My apologies.