Using JWT for Loopback authentication

Question

I'm trying to understand how I can fit a custom JWT routing into loopbacks security model. My application has an authentication "dance" involving SMS that results in a valid JWT token using the excellent description. I'm using the jsonwebtoken and things work as expected. After obtaining the token my angular.js client sends the token with each request in the Authorisation: JWT ..token.. header (found conflicting documentation, one says JWT, one Bearer, but I can figure that out).

Now I want to make use of the token inside a loopback application. I'd like to use the ACL system loopback provides. I did read the following resources:

And I'm not clear what my next steps are. I have working:

User 'login' - generating a JWT
User login using username/password (to be retired)
Working ACL implementation in loopback (when I access an ACL protected resource I get, as expected a 4xx error)
My JWT token properly (?) in the header of the request

I need:

based on the JWT token a valid user with roles compatible to loopback ACL

Help is very much appreciated

Did you ever figure this out? – denislexic Jan 30 '16 at 13:43 — denislexic, Jan 30 '16 at 13:43
Thx for reminding me. Yes I did. Answer below – stwissel Feb 01 '16 at 17:02 — stwissel, Feb 01 '16 at 17:02
The authentication scheme for JWT tokens is "Bearer". – Fred Jun 19 '18 at 08:56 — Fred, Jun 19 '18 at 08:56

score 3 · Answer 1 · answered Feb 01 '16 at 17:12

The solution turned out to be much simpler that I though it would be. For starters loopback does use its own jwt webtokens to keep a (stateless) user session. After establishing identity (in my case extracting the mobile number from my JWT token) I just need to lookup the member and generate the loopback native JWT token. My endpoint definition was this:

  Member.remoteMethod(
    'provideSMSToken', {
      accepts: [{
        arg: 'mobilenumber',
        type: 'string',
        description: 'Phone number including +65 and no spaces'
      }, {
        arg: 'token',
        type: 'string',
        description: 'the token received through SMS'
      }],
      returns: {
        arg: 'token',
        type: 'string'
      },
      description: 'provide SMS token to confirm login',
      http: {
        path: '/smsauthenticate',
        verb: 'post'
      },
      isStatic: true
    }

  );

and the provideSMSToken function like that:

 // Exchange the SMS Token with a login token
  Member.provideSMSToken = function(mobilenumber, token, cb) {
    var app = Member.app;
    // CHeck if the token does exist for the given phone number
    // if yes, check for the respective memeber

    if (!app.smsVerificationToken || !app.smsVerificationToken[mobilenumber] || app.smsVerificationToken[mobilenumber] !== token) {
      var wrongToken = new Error("Wrong or missing token");
      cb(wrongToken, "Wrong or missing token");
    } else {
      var timetolive = 86400;
      Member.lookupByPhone(mobilenumber, function(err, theOne) {
        if (err) {
          cb(err, "Sorry, no such member here!");
        } else {
          // We can provide a token now for authentication
          // using the default createAccessToken method
          theOne.createAccessToken(timetolive, function(err, accesstoken) {
            cb(err, accesstoken);
          })
        }
      });
    }
  }

Works like a charm

I'm using loopback but it's not using JWT and I've been looking to implement them. Did you have to configure something or it uses JWT out of the box? — fmtoffolo, Mar 25 '16 at 21:54
Loopbacks or gateway? Because my db is storing tokens and they dont have the normal jwt structure. — fmtoffolo, Mar 27 '16 at 14:25
JWT is encoded (not encrypted) signed arbitrary content. There is no such thing as 'normal' structure. But you might want to ask a new question and propose all moving parts. When you provide incomplete information you won't get the answer you are looking for — stwissel, Mar 28 '16 at 04:54
JWT's have a "normal structure". It consists of a header, payload and signature, separated by dots - see https://jwt.io . The access-token used in our LoopBack app doesn't have three sections and don't decode to any payload and are not stateless as they are stored in the DB. (At least the implementation that I'm working on). I also don't see anything in the loopback docs about JWT. Any chance you could send some links to something that explains how to use JWT's in loopback? — hofnarwillie, Jun 27 '17 at 08:50

Using JWT for Loopback authentication

1 Answers1