CODEWITHSUNDEEP
laravellaravel-8laravel-authenticationlaravel-authorization
Bad Programmer
Bad Programmer

Reputation: 962

What Am I Missing for this Custom Authentication in Laravel 8

I have a website that uses SAML2 for authentication. I don't manage the SSO at all, rather my site is part of a portal that requires SSO authentication for entry. I currently have middleware that gets the SAML attributes from the request->server object, and then does a variety of tasks, like check to see if they have affiliations, if those affiliations are allowed, etc...

This middleware was added to the kernel so that it runs for every HTTP request. I want to revamp this middleware to make it cleaner, and to also use Laravel's native Auth facade (we're checking to see if a session variable for a user has been set to determine if the user has already logged in, versus auth->check(), for example).

I've read several tutorials on how to bypass the authentication that comes with the Laravel Breeze starter kit and make your own. None quite matches what I need to do, but the concepts are the same:

  1. Create a model (using the User model that was already there, with a few tweaks)
  2. Create a Service provider (created anew provider that implements the UserProvider interface)
  3. Create a Guard (created a new guard that implements the Guard interface)

I can understand those three things and did them, but I am unsure of how to put it all together.

I updated my config/auth.php file to include the new guard and provider: enter image description here

enter image description here

I then updated the boot method of App\Providers\AuthServiceProvider to include the provider and guard that I created:

enter image description here

But now what? I guess this is the part I am missing.

Can someone more knowledgeable help me fit in the missing pieces? I am using Laravel Framework 8.73.1.

Upvotes: 0

Views: 839

Answers (1)

gbalduzzi
gbalduzzi

Reputation: 10176

Now you just need to protect your routes using the auth laravel middleware (assuming your guard and provider implementations are correct)

You have two options:

  1. Replace the default guard. Open config/auth.php and look for the lines:
'defaults' => [
        'guard' => 'web', // --> Replace with saml
        'passwords' => 'users',
    ],

Now, add the auth middleware to your routes and you are good to go. You can use the Auth facade as described in the laravel documentation.

  1. Keep the laravel one as the default, and use your guard separately. You just need to specificy which guard to use whenever you use the Auth facade or middleware.

The middleware you need to use is auth:saml, and the facade calls must be prefixed with guard('saml'). E.g. Auth::guard('saml')->user().

Upvotes: 1

Related Questions