passport-oauth2-resource-owner-password

OAuth 2.0 resource owner password authentication strategy for Passport.

This module lets you authenticate requests containing resource owner credentials in the request body, as defined by the OAuth 2.0 specification.

Install

npm install passport-oauth2-resource-owner-password

Usage

Configure Strategy

The OAuth 2.0 resource owner password authentication strategy authenticates clients using a client ID, username, and password The strategy requires a verify callback, which accepts those credentials and calls done providing a client.

passport.use(new ResourceOwnerPasswordStrategy(
  function(clientId, clientSecret, username, password, done) {
    Clients.findOne({ clientId: clientId }, function (err, client) {
      // this strategy does not require clientSecret as it is intended to be used in cases
      // (such as mobile apps) which are inherintly insecure

      if (err) { return done(err); }
      if (!client) { return done(null, false); }

      Users.findOne({ username: username }, function (err, user) {
        if (err) { return done(err); }
        if (!user) { return done(null, false); }
        if (hashsum(user.salt + password) !== user.secret) { return done(null, false); }

        return done(null, { client: client, user: user });
      })
    });
  }
));

Authenticate Requests

Use passport.authenticate(), specifying the 'oauth2-resource-owner-password' strategy, to authenticate requests.

For example, as route middleware in an Express application, using OAuth2orize middleware to implement the token endpoint:

app.get(
  '/oauth/token'
, passport.authenticate(
    [ 'basic'
    , 'oauth2-client-password'
    , 'oauth2-resource-owner-password'
    ]
  , { session: false }
  )
, oauth2orize.token()
, oauth2orize.errorHandler()
);

Examples

The example included with OAuth2orize demonstrates how to implement a complete OAuth 2.0 authorization server. ResourceOwnerPasswordStrategy is used to authenticate clients as they request access tokens from the token endpoint.

Tests

TODO

npm install --dev
make test

Credits

AJ ONeal

The Client Password Strategy by Jared Hanson was used as a template to create this.

License

The MIT License