Authentication strategy to support anonymous mobile users.
Switch branches/tags
Clone or download
Latest commit ffb645d Nov 16, 2015
Permalink
Failed to load latest commit information.
doc updated versions, tests Nov 16, 2015
lib updated versions, tests Nov 16, 2015
src updated versions, tests Nov 16, 2015
test updated versions, tests Nov 16, 2015
.gitignore first commit Sep 4, 2014
.npmignore first commit Sep 4, 2014
.travis.yml try this again Sep 4, 2014
Gruntfile.coffee upgraded to hapi 8.0 Dec 31, 2014
README.md upgraded to hapi 8.0 Dec 31, 2014
package.json release 3.0.1 Nov 16, 2015

README.md

Build Status Coverage Status NPM Version Dependency Status NPM Downloads Issues HAPI 8.0 API Documentation

(C) 2014 Martin Wawrusch

HAPI plugin that supports anonymous logins from mobile devices.

  1. PLEASE NOTE THAT SIGNIFICANT PARTS OF THE CODE HAVE BEEN USED FROM ANOTHER NPM MODULE (hapi-auth-bearer by Jordan Stout)

  2. ALSO, THIS IS WORK IN PROGRESS

  3. THIS IS OBVIOUSLY NOT SECURE AS IN BANK LEVEL SECURITY - IT'S FOR CASUAL APPS ONLY

How does this work?

The scenario is like this: A user opens an app on a mobile device, and is identified by some persistent UUID. Each request to the backend includes an Authorization: anonymous [UUID] header. The UUID can be any format as long as it is a string. This module now ensures that, either a new user is created in the backend or an existing user with that id is retrieved. Voila, we support anonymous users.

Dependencies

This module requires the following HAPI modules to be loaded:

and a mongoose connector plugin (does not have to be this one)

How to use it?

Hapi = require "hapi"

hapiAuthAnonymous = require 'hapi-auth-anonymous'
hapiOauthStoreMultiTenant = require 'hapi-oauth-store-multi-tenant'
hapiUserStoreMultiTenant = require 'hapi-user-store-multi-tenant'
hapiMongooseDbConnector = require 'hapi-mongoose-db-connector'
      
server = new Hapi.Server config.server.port, config.server.host, {}

pluginConf = [
    plugin: hapiUserStoreMultiTenant
    options:
      autoIndex: false     
  ,
    plugin: hapiOauthStoreMultiTenant
    options:
      autoIndex: false     
  ,
    plugin: hapiAuthAnonymous
    options:
      clientId: '53af466e96ab7635384b71fa'
      _tenantId: '53af466e96ab7635384b71fb'
      scope: ['user-anonymous-access'] # This is optional and represents the default
  ,
    plugin: hapiMongooseDbConnector
    options:
      mongodbUrl: config.services.mongodbUrl
]

server.pack.register pluginConf, (err) ->
  throw err if err

  server.auth.strategy 'default', 'hapi-auth-anonymous',  {}
  server.auth.default 'default'

  server.start -> 
    # Do something

module.exports = server

Plugin Options

clientId

The client id used to identity the oauth app. In a usual setup you create one app when initializing your database for the first time and use that client id. Take a look at the hapi-routes-tenants-setup plugin that exposes a setup route.

_tenantId

An id that specifies which tenant in the identity store backend should be used. In most scenarios this will be a hardcoded (well, taken from the config) value. It must be a mongodb compatible object id (see example above).

scope

The scope that will be assigned to the credentials upon login. This defaults to ['user-anonymous-access'] and can be either a string or an array. To assign no scope, pass an empty array.

The scope allows you to limit access or functionality in your routes. For example, a route that returns data can only return a subset for users in scope anonymous-access

See also

and additionally

Contributing

  • Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet
  • Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it
  • Fork the project
  • Start a feature/bugfix branch
  • Commit and push until you are happy with your contribution
  • Make sure to add tests for it. This is important so I don't break it in a future version unintentionally.
  • Please try not to mess with the package.json, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so I can cherry-pick around it.

Copyright

Copyright (c) 2014 Martin Wawrusch