How to get separated auth for admin and user models in Adonis JS

[biswa34]

Is it possible to have separated Auth for different models in Adonis Js?
I have two different table for admins and users and want to have separated Auth.

How can I setup this in adonis js ?

[guntribam]

It's possible.

First thing you need is to understand how can you create a custom user provider. After that take a look at the interface UserProviderContract, depending on the guard you choose(let's assume it's basic) go to the method called findByUid, i'll paste the implementation of the LucidProvider

/**
 * Returns the user instance by searching the uidValue against
 * their defined uids.
 */
async findByUid(uidValue) {
    const model = await this.getModel();
    /**
     * Use custom function on the model. This time, we do not emit
     * an event, since the user custom lookup may not even
     * run a query at all.
     */
    if (typeof model.findForAuth === 'function') {
        const user = await model.findForAuth(this.config.uids, uidValue);
        return this.getUserFor(user);
    }
    /**
     * Lookup by running a custom query.
     */
    const { query } = await this.getModelQuery();
    this.config.uids.forEach((uid) => query.orWhere(uid, uidValue));
    return this.findUser(query);
}

As you can see this is one place where you'll get the model you want(if you're using BASIC guard, other guards rely on other methods as well). With your custom user provider you'll implement this method and choose the between Admins or Users as you can see fit...

[guntribam]

You can use inheritance too...depending on the data of Admins and Users...

[biswa34]

Hello @guntribam Thanks for your reply.
I am using Adonis Version 5 . I don't understand where to use the above code given by you.

Let's Say I have two models. App/Models/User and App/Models/AdminUser
Inside config/auth.ts, do I need to create multiple authenticators for admin and user ? If yes then How ?
Kindly give examples.

Kindly let me know.

In short I want to create an application with Adonis that Have 2 or 3 Login. One for User and another for SuperAdmin and other for Admin.

I am new to this. Kindly Help.

[guntribam]

hey @biswa34 i don't want to sound rude, but i'll not solve your problem. I can give you directions:

• Before building a custom user provider, build a simple app with authentication

• Understand the concept of guard and provider(read the docs)

• Before building a custom user provider read the docs for it, and take a look at the code of Lucid Provider and the interface you'll have to implement

Please read the docs you'll gain time...

Good luck

[biswa34]

After adding admin guard I got this error.

[biswa34]

Added this on GuardList of contracts/auth.ts :

 admin: {
      implementation: BasicAuthGuardContract<'user', 'web'>,
      config: BasicAuthGuardConfig<'user'>,
    },

By adding this other error are gone but there are still some errors like this.

I have created a custom user provider named AdminAuthProvider. like this:

But still not get the way to implement it. Correct me if I am wrong. Provide me the directions.

[biswa34]

@guntribam Can I get help ? It's very urgent. I have tried but it's not happening. May be I can't get the root of the process.

So if you tell the way then It will be very much helpful.

[guntribam]

First thing you must do: stop pasting images here. Use the code formatter.

Maybe you don't even need a custom auth guard...but since you're saying you need it, i won't go in that way...

Since you're using auth package you must keep checking these files: config/auth.ts and contracts/auth.ts
I don't know if you're using a middleware, if so...check app/Middleware/Auth.ts you can start to debug your code here...

• Try to find which method the Auth middleware call
• Look for node_modules -> @adonisjs -> auth -> build -> src -> Guards and check the Base guard js code and your driver session js code. Start doing console.logs to find where your code run...

I don't know what is happening to your code from these images. But i will try to show you a example of a custom auth provider that i build:

this is my config/auth.ts the interface used for this provider is inside providers/LdapProvider/index.ts

import { AuthConfig } from '@ioc:Adonis/Addons/Auth'
import Env from '@ioc:Adonis/Core/Env'

const authConfig: AuthConfig = {
  guard: 'basic',
  guards: {
    basic: {
      driver: 'basic',
      realm: 'Login',

      provider: {
        driver: 'ldap',
        connection: 'mpdft',
        ldapHost: Env.get('LDAP_HOST'),
        ldapAdminDn: Env.get('LDAP_ADMIN_DN'),
        ldapAdminPassword: Env.get('LDAP_ADMIN_PASSWORD'),
        ldapUserSearchBase: Env.get('LDAP_USER_SEARCH_BASE'),
        ldapUserAttribute: Env.get('LDAP_USER_ATTRIBUTE'),
        model: () => import('App/corporativo/pessoa/Pessoa'), //path of my model
      },
    },
  },
}

export default authConfig

this is my contracts/auth.ts the types used here are inside providers/LdapProvider/index.ts

import { LdapProvider, LdapProviderConfig } from 'providers/LdapProvider';

declare module '@ioc:Adonis/Addons/Auth' {
   interface ProvidersList {
       user: {
      implementation: LdapProvider,
      config: LdapProviderConfig,
    },
  }
 
  interface GuardsList {
       basic: {
      implementation: BasicAuthGuardContract<'user', 'basic'>,
      config: BasicAuthGuardConfig<'user'>,
    },
  }
}

this is my providers/LdapProvider/index.ts. I need to check username and password on LDAP before getting the model of that username. I build a custom user provider to check LDAP and do not check password on the database. The method that start all of this is findByUid

import { ProviderUserContract, UserProviderContract } from '@ioc:Adonis/Addons/Auth'
import { Exception } from '@poppinss/utils'
import { esmResolver } from '@poppinss/utils'
import { Client, SearchResult } from 'ldapts'
import Pessoa from 'App/corporativo/pessoa/Pessoa'

class LdapUser implements ProviderUserContract<Pessoa> {
  constructor(
    public user: Pessoa | null,
    private config: LdapProviderConfig,
    private userDN?: string
  ) {}

  public getId() {
    return this.user ? this.user.id : null
  }

  public async verifyPassword(plainPassword: string): Promise<boolean> {
    return await this.isAuthenticated(plainPassword)
  }
  public getRememberMeToken() {
    throw new Exception('Não implementado -> getRememberMeToken')
    return null
  }

  public setRememberMeToken(token: string) {
    throw new Exception('Não implementado -> setRememberMeToken' + token)
  }

  private async isAuthenticated(password: string): Promise<boolean> {
    const { ldapHost: url } = this.config
    const client = new Client({ url })
    let isAuthenticated
    try {
      await client.bind(this.userDN ?? '', password)
      isAuthenticated = true
    } catch (ex) {
      isAuthenticated = false
    } finally {
      await client.unbind()
    }
    return isAuthenticated
  }
}

//This is the type used in the config
export type LdapProviderConfig = {
  driver: 'ldap'
  connection: string
  ldapHost: string
  ldapAdminDn: string
  ldapAdminPassword: string
  ldapUserSearchBase: string
  ldapUserAttribute: string
  model: () => Promise<any> | Promise<{ default: any }>
}

export class LdapProvider implements UserProviderContract<Pessoa> {
  constructor(private config: LdapProviderConfig) {}

  public async getUserFor(user: Pessoa | null, userDN?: string) {
    return new LdapUser(user, this.config, userDN)
  }

  public async updateRememberMeToken() {
   throw new Error('not implemented")
  }

  public async findById(id: string | number) {
    const { query } = await this.getModelQuery()
    const user = await query.where('id', id).first()
    return this.getUserFor(user)
  }

  public async findByUid(uidValue: string) {
    const userDN = (await this.findUserDNByUsername(uidValue)) || (()=>{throw new Error('Usuário não encontrado')})()
    const { query } = await this.getModelQuery()
    const user = await query.whereHas('usuario', (q) => q.where('login', uidValue)).first()
    return this.getUserFor(user, userDN)
  }

  private getModelOptions() {
    return this.config.connection ? { connection: this.config.connection } : {}
  }

  public async findByRememberMeToken(id: string | number, value: string) {
    throw new Error("not implemented")
    return new LdapUser(null, this.config)
  }

  private async getModelQuery() {
    let model: any = esmResolver(await this.config.model())
    return { query: model.query(this.getModelOptions()) }
  }

  private async findUserDNByUsername(username: string): Promise<string | false> {
    const { ldapHost: url } = this.config
    const client = new Client({ url })
    let searchResult: SearchResult
    try {
      await client.bind(this.config.ldapAdminDn, this.config.ldapAdminPassword)
      searchResult = await client.search(this.config.ldapUserSearchBase, {
        scope: 'sub',
        filter: `(${this.config.ldapUserAttribute}=${username})`,
      })
    } catch (ex) {
      throw new Error(ex)
    } finally {
      await client.unbind()
    }
    return searchResult.searchEntries.length > 0 ? searchResult.searchEntries[0].dn : false
  }
}

This is how you register your custom provider on AppProvider:

import { ApplicationContract } from '@ioc:Adonis/Core/Application'

export default class AppProvider {
  constructor(protected app: ApplicationContract) {}

  public  register() {
    // Register your own bindings
  }

  public async boot() {
    // IoC container is ready
    const { LdapProvider } = await import('./LdapProvider')
    const auth = this.app.container.use('Adonis/Addons/Auth')
    auth.extend('provider', 'ldap', (_, __, config) => new LdapProvider(config))
  }

  public async ready() {
    // App is ready
  }

  public async shutdown() {
    // Cleanup, since app is going down
  }
}

I hope this help you in some way...

[biswa34]

It looks complicated. If we don't use a custom auth guard then how can it be done.
@guntribam

[guntribam]

It's not complicated. You just need time to read the docs, understand concepts and debug your code. Sorry, but this is the last time i've tried to help you, it is clear to me that you don't want help, you want someone to solve the problem for you. Don't mention me again...