Laravel Passport - 401 unauthorised and specifying auth guard?

[Adam-78]

I have a laravel 5.6.3 application with multiple guards as follows:

auth.php

'guards' => [
    'web' => [
         'driver' => 'session',
         'provider' => 'users',
     ],

    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ],

    'admin' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
],

I login using the admin guard.

I add the passport view components to a page only accessible by admin which has the following route: http://127.0.0.1:8000/admin/passport/

<passport-clients></passport-clients>
<passport-authorized-clients></passport-authorized-clients>
<passport-personal-access-tokens></passport-personal-access-tokens>

When I load the page with the above components I am getting console errors as follows:

http://127.0.0.1:8000/oauth/clients 401 (Unauthorized)
http://127.0.0.1:8000/oauth/tokens 401 (Unauthorized)
http://127.0.0.1:8000/oauth/personal-access-tokens 401 (Unauthorized)
http://127.0.0.1:8000/oauth/scopes 401 (Unauthorized)

If I log in using the web guard and add the above vue components to a page accessible by web then it works fine.

Looking through the https://github.com/laravel/passport/blob/6.0/src/RouteRegistrar.php you will note the router group only has web and auth but no option to pass in a guard?

 public function forClients()
{
     $this->router->group(['middleware' => ['web', 'auth']], function ($router) {
          //...
      });
 }

So the question is how can I get this to work if I'm logged in as admin - in otherwords how can I pass in an authentication gaurd?

[driesvints]

Hi there,

Looks like this is a question which can be asked on a support channel. Please only use this issue tracker for reporting bugs with the library. If you have a question on how to use functionality provided by this repo you can try one of the following channels:

• Laracasts Forums
• Laravel.io Forums
• Discord
• Larachat
• IRC
• StackOverflow

[Adam-78]

Hi,

Already asked on multiple channels without any success: https://stackoverflow.com/questions/52916900/laravel-passport-401-unauthorised-and-specifying-auth-guard

Is this even remotely possible - defining the auth guard?

[driesvints]

There's a feature request open to update middlewares to ['api', 'auth:api'] but I'm not sure if they'll ever get support for custom guards. That also shouldn't be necessary I believe because the clients are always created on a user level.

https://github.com/laravel/passport/issues/379

[Adam-78]

It would be useful because you could have two different types of users e.g. Jobseeker and Recruiter - the provider for both would be the users table but you might have different logins for each type of user using a dedicated auth guard:

'guards' => [

     'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'jobseeker' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'recruiter' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'admin' => [
        'driver' => 'session',
        'provider' => 'users',
     ],
 ]

Using the out the box passport vue-components are rendered useless in the above scenario since you cant authenticate against a guard .e.g if you place the passport-vue components on a page only accessible by admins and you are logged in as admin they don't work. you have to be logged in using the default web guard for them to work.

[driesvints]

@Adam-78 they're using the same provider?

Also: everything for the clients, etc shouldn't have different behavior. That's also a reason why the current middleware should be updated to the api one. It shouldn't behave differently for different types of guards. It's always connected to a user, regardless from what type it is.

[jareerzeenam]

There's a feature request open to update middlewares to ['api', 'auth:api'] but I'm not sure if they'll ever get support for custom guards. That also shouldn't be necessary I believe because the clients are always created on a user level.

379

Thank you so much, this worked !!

[dmoxyeze]

There's a feature request open to update middlewares to ['api', 'auth:api'] but I'm not sure if they'll ever get support for custom guards. That also shouldn't be necessary I believe because the clients are always created on a user level.

379

Thank you so much, this worked !!

Please how did you implement this?