JWT for local auth.

[muvhaus-sl]

Hi,

I'm trying to make OAuth (Facebook) and Local authentication to work. So far, I got OAuth to work as expected and the JWT I get on the client includes a UserID.

However, when trying to use Local, I always get a JWT, but with no userID. Irrespective if the credentials are correct or not.
The JWT looks like:
{
aud:"my domain"
exp: 1483..........
iat: 1483...........
iss:"feathers"
sub:"anonymous"
}

Please let me know how I can explain myself better.

I'm using:
"feathers": "^2.0.3",
"feathers-authentication": "^1.0.2",
"feathers-authentication-client": "^0.1.6",
"feathers-authentication-jwt": "^0.3.1",
"feathers-authentication-local": "^0.3.2",
"feathers-authentication-oauth2": "^0.2.3",
"feathers-configuration": "^0.3.3",
"feathers-errors": "^2.5.0",
"feathers-hooks": "^1.7.1",
"feathers-permissions": "^0.1.1",
"feathers-rest": "^1.6.0",
"feathers-sequelize": "^1.4.0",
...
"passport": "^0.3.2",
"passport-facebook": "^2.1.1",
"passport-facebook-token": "^3.3.0",
"passport-google-oauth20": "^1.0.0",
"passport-google-token": "^0.1.2",
"passport-local": "^1.0.0",

[marshallswain]

Please post your auth config and the auth setup that you have in place on the server.

[muvhaus-sl]

Hi, this is how my auth setup + config looks like:
Please let me know if you need more info.

app.configure(auth({
"local":{},
"cookie": {
"enabled": true,
"name": "feathers-jwt",
"httpOnly": false,
"secure": false,
"domain": "my domain"
},
"jwt": {
"header": { "typ": "access" },
"audience": "my domain",
"subject": "anonymous",
"issuer": "feathers",
"algorithm": "HS256",
"expiresIn": "1d"
},
"session":false,
"secret": " there is a secret here...",
"facebook": {
"clientID": "my facebook app ID",
"clientSecret": "my facebook secret",
"scope": ["public_profile","email"],
"profileFields": ["id", "displayName", "email", "name", "cover", "picture"] //seems irrelevant
},
"google": {
"clientID": "your google client id",
"clientSecret": "your google client secret",
"scope": ["profile"]
}
}))
.configure(jwt())
.configure(local())
.configure(oauth2({
name: 'facebook', // if the name differs from your config key you need to pass your config options explicitly
Strategy: FacebookStrategy
}))
.configure(oauth2({
name: 'google', // if the name differs from your config key you need to pass your config options explicitly
Strategy: GoogleStrategy
}));

[bertho-zero]

app.configure( auth( {
  "local": {},
  "cookie": {
    "enabled": true,
    "name": "feathers-jwt",
    "httpOnly": false,
    "secure": false,
    "domain": "my domain"
  },
  "jwt": {
    "header": { "typ": "access" },
    "audience": "my domain",
    "subject": "anonymous",
    "issuer": "feathers",
    "algorithm": "HS256",
    "expiresIn": "1d"
  },
  "session": false,
  "secret": " there is a secret here...",
  "facebook": {
    "clientID": "my facebook app ID",
    "clientSecret": "my facebook secret",
    "scope": [ "public_profile", "email" ],
    "profileFields": [ "id", "displayName", "email", "name", "cover", "picture" ] //seems irrelevant
  },
  "google": {
    "clientID": "your google client id",
    "clientSecret": "your google client secret",
    "scope": [ "profile" ]
  }
} ) )
  .configure( jwt() )
  .configure( local() )
  .configure( oauth2( {
    name: 'facebook', // if the name differs from your config key you need to pass your config options explicitly
    Strategy: FacebookStrategy
  } ) )
  .configure( oauth2( {
    name: 'google', // if the name differs from your config key you need to pass your config options explicitly
    Strategy: GoogleStrategy
  } ) );

[muvhaus-sl]

Thank you Bertho-zero for the formatting, much appreciated.

[muvhaus-sl]

Am I doing something wrong and thats the cause of the issue?

[marshallswain]

@muvhaus-sl are you registering the authenticate hook on the authentication service?

[muvhaus-sl]

Thank you very much. I missed that simple, yet very important step.

Now, the only doubt I still have, given that I would like to support multiple types of authentication, do I need to list them like:

create: [
		  // You can chain multiple strategies
		  auth.hooks.authenticate(['jwt', 'local','facebook','google']),
		],

Or must I leave as is on the sample?

[marshallswain]

Yep, you got it right. List them in the strategies array. When you authenticate, make sure you include the strategy name and only the named strategy will run.

For example, with local auth, this will only run against the local strategy on the server.

app.authenticate({
  strategy: 'local',
  email: 'what@ever.com',
  password: '1234'
});

[muvhaus-sl]

great!

Thank you very much for the help.

If you don't mind, have a look at the other issue I opened, I might have missed something or found a a real issue.