Fortify: Authenticate using API JSON Response

@vincent15000

<?php

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable
{
    /**
     * The attributes that are mass assignable.
     *
     * @var string[]
     */
    protected $fillable = [
        'id',
        'twoFactorEnabled',
        'name'
    ];
}

@vincent15000 Added to OP.

@jlrdw No, it's a application built in Laravel, however the database, and user system is API based.

@jlrdw + It cannot be built in VueJS or any JS framework, as our employer(UK Bank) has deemed JS too security vulnerable.

@jwhm you will need token based auth, if using sanctum, see that chapter read the differences between spa and regular API.

You can use guzzle or curl, I suggest laravel passport.

@jlrdw None of those are solutions that are viable.

$api->find($request->username);

Is using Guzzle to query the user API, to find the user data associated with that user.

{
    "userid": "1",
    "twoFactorEnabled": "false",
    "name": "Test User"
}

@jwhm I suggest reading the chapter on Passport and viewing the Passport video, then decide how to proceed.

@jlrdw

I think you're missing the point of this post. I cannot use Sanctum, or Passport as they aren't applicable to what needs to be completed here.

All I am trying to do, is created a auth session, via Fortify's authenticate using, I cannot access the APi's database nor can I change anything about the API, or the database.

I have access to only two endpoints api.com/v1/validate(username, password) which returns their userid if successful, I then need to use their user id provided by validate, to find their user data via api.com/v1/find, which all works fine.

The part I am struggling with is actually creating the Fortify session.

@jwhm well you have password mis-spelled: You have:

$request->passwprd

@jlrdw I know. That's not the source of the problem.

($user) must be of type Illuminate\Contracts\Auth\Authenticatable, array given.

@jwhm you haven't set content type:

'content-type' => 'application/json',
'Accept' =>'application/json',

Please explain more about the API, is it an actual API, or just regular web application.

Have you looked at examples here: https://laravel.com/docs/8.x/http-client

@jlrdw Yes, it's an actual API. $api is a injected class(ApiProvider $api) which is a wrapper for a preconfigured Guzzle client. $api->validate sends a request to example.com/v1/validate{username, password}, which if successful, returns a user_id in JSON array. Then, $api->find($user_id) will contact example.com/v1/find{user_id }, which will return the user's name, company, etc which then, a session needs to be created containing that user's data, such as their name, company etc.

@jwhm on the Fortify::authenticateUsing method have you tried:

$user = User::where('username', $request->username)->first(); // would need to be unique

Like the example from docs: https://laravel.com/docs/8.x/fortify#customizing-user-authentication

And have you setup the app to use username instead of email?

@jlrdw The database and API isn't stored on the webserver where this application is being produced and deployed. There is NO database on the server that is accessible via this application.

The API isn't on this server, or within this Laravel installation. The ONLY way is to send a post request to example.com/v1/validate{username, password} - ergo, any Database operations within this application WILL NOT work as there is NO database access via this Laravel applications so all Eloquent operations WILL fail.

@jwhm exactly where do you get $request->username from? Where is username stored.

Where is the database you are attempting to authenticate against?

@jlrdw the database is behind the api I am sending requests to via the $api->validate/find.

$request->username, is coming from Fortify which intercepts the $request from any post request to /login.

@jwhm see this: https://stackoverflow.com/questions/44875288/guzzle-laravel-login-using-post-request

Another example https://stackoverflow.com/questions/41690733/guzzle-post-request-with-auth

Just make non ajax since you can't use javascript.

Edit: You could also try manual Auth instead of fortify:

https://laravel.com/docs/8.x/authentication#authenticating-users