6

Please, can anybody explain how to implement multiple authentication guards in Lumen framework? Currently, I have two authenticatable models: Users and Clients. I'm using a custom implementation of JWT. A User has client_id and user_id fields in their token payload. While a Client only has client_id. Based on this I need to determine who came to me: client, user or guest (without a token).

auth.php

'guards' => [
    'client' => [
        'driver' => 'token',
        'provider' => 'clients',
    ],
    'user' => [
        'driver' => 'token',
        'provider' => 'users',
    ],
],

'providers' => [
    'clients' => [
        'driver' => 'eloquent',
        'model' => App\Client::class,
    ],
    'users' => [
        'driver' => 'eloquent',
        'model' => App\User::class,
    ],
],

AuthServiceProvider.php

public function boot()
{
    $this->app['auth']->viaRequest('token', function ($request) {
        $access_token = HelperClass::getTokenFromHeader($request->headers->get('Authorization'));

        if ($access_token) {
            $tokendata = JWT::decode($access_token, getenv('TOKEN_SECRET'), array('HS256'));

            if ($tokendata->user_id) {
                return User::find($tokendata->user_id);
            }

            return Client::find($tokendata->client_id);
        }
    });
}

routes.php

$app->get('/api/{item_id:\d+}', ['middleware' => 'auth:user', 'uses' => 'App\Http\Controllers\ItemController@get']);

I want to allow only Users to access this route, but Clients successfully pass this middleware too: Auth::check() returns true and Auth::user() returns an instance of App\Client

Another situation: what if for some routes I want to allow both: clients and users. For another routes - guests, clients and users.

Kurt Friars
  • 3,625
  • 2
  • 16
  • 29
chimit
  • 548
  • 5
  • 20

0 Answers0