Authentication with JWT Laravel 5 without password

Question

I am trying to learn Laravel and my goal is to create a RESTful API (without using views or clicks, only JSON results. Later, the AngularJS web application and the Cordova hybrid mobile app will use this api.

After some research, I tend to choose the JWT-Auth library for full stateless benefits. My problem: I have 2 main types of users: clients and moderators . Customers are not required to have a password. I need to be able to generate a token for access only with the email provided. If this letter exists in the database and belongs to the client, it will generate and return a token. If it exists and belongs to the moderator, it will return false so that the interface can request a password. If the letter does not exist, it throws an invalid parameter error.

I read the docs here and it says you can use custom claims. But the documents do not explain what the claims are, and what this means is that the array is passed as user requirements. I would like information on how to achieve what I explain above.

<?php namespace App\Http\Controllers; use Illuminate\Http\Request; use App\Http\Requests; use App\Http\Controllers\Controller; use JWTAuth; use Tymon\JWTAuth\Exceptions\JWTException; class AuthenticateController extends Controller { public function authenticate(Request $request) { $credentials = $request->only('email', 'password'); try { // verify the credentials and create a token for the user if (! $token = JWTAuth::attempt($credentials)) { return response()->json(['error' => 'invalid_credentials'], 401); } } catch (JWTException $e) { // something went wrong return response()->json(['error' => 'could_not_create_token'], 500); } // if no errors are encountered we can return a JWT return response()->json(compact('token')); } } 

Thanks.

Update

Reward code

 public function authenticate(Request $request) { $email = $request->input('email'); $user = User::where('email', '=', $email)->first(); try { // verify the credentials and create a token for the user if (! $token = JWTAuth::fromUser($user)) { return response()->json(['error' => 'invalid_credentials'], 401); } } catch (JWTException $e) { // something went wrong return response()->json(['error' => 'could_not_create_token'], 500); } // if no errors are encountered we can return a JWT return response()->json(compact('token')); } 

Answer 1

try with this:

 $user=User::where('email','=','[e-mail]')->first(); if (!$userToken=JWTAuth::fromUser($user)) { return response()->json(['error' => 'invalid_credentials'], 401); } return response()->json(compact('userToken')); 

it works for me hopefully can help

Answer 2

Creating a token for clients (without a password) can be achieved using

 $user = \App\Modules\User\Models\UserModel::whereEmail('[e-mail]')->first(); $userToken=JWTAuth::fromUser($user); 

Here $userToken will store the token after checking for email in the table configured in the UserModel file.

I assumed that you keep both clients and moderators in one table, there should be some flag for them. Assume user_type flag

 $token = null; $user = \App\Modules\User\Models\UserModel::whereEmail('[e-mail]')->first(); if($user['user_type'] == 'customer'){ $credentials = $request->only('email'); $token =JWTAuth::fromUser($user); }else if($user['user_type'] == 'moderator'){ $credentials = $request->only('email','password'); $token = JWTAuth::attempt($credentials); }else{ //No such user exists } return $token; 

Regarding user requirements, these are custom user values ​​that can be attached to the token string.

For example, JWTAuth::attempt($credentials,['role'=>1]); Will try to add a role object to the marker payload. After you decode the token string through the JWT Facade JWTAuth::parseToken()->getPayload(); , you, in turn, will get all the useful values ​​in required_claims in the config / jwt.php file with an additional role payload.

Contact https://github.com/tymondesigns/jwt-auth/wiki/Creating-Tokens#creating-a-token-based-on-anything-you-like Let me know if you require anything else.

Answer 3

Instead of creating different login strategies for clients and moderators, you can add token authentication for both types of users. it will simplify your life and prepare for scalability. In your api, you can simply limit the moderator users to the lack of access to the api by sending

 <?php Response::json('error'=>'method not allowed') 

Other than this suggestion, I believe that @Alimnjan code should work.