Creating a non-oauth Meteor Accounts package

Question

The accounts-foobar packages all rely on oauth-based authentication systems, and involve quite a bit of confusing, undocumented boilerplate. I'm wondering if there's an easy way to create a package for a non-oauth authentication system that will integrate normally with the Meteor accounts system. The non-oauth system I have in mind is a simple external API that just accepts a username and password, and returns a simple json object with success data or an error.

Is there a simple way to do this? Does Meteor provide an API for this that I've missed?

EDIT: This bit works fine, I'm just not entirely sure how to hook this up to the accounts system:

HTTP.post('https://my-site.com/api/login.json', { params: { username: 'foo', password: 'bar' } }, function (error, result) {
    if (result) console.log('User data:', result.data);
});

// User data: { userId: 217, username: "foobar" }

Answer 1

It looks like Meteor's accounts-password packages should work for you (simple username/password based auth), however if you need something custom you can do it yourself.

You can roll your own auth package if you don't want to use any of the built in accounts-* packages. You simply need to register your own login handler and do a little bit of bookkeeping to keep the sessions authenticated on reconnects.

Step by step:

1: Add accounts-base package: meteor add accounts-base

2: On the server, add a Accounts.registerLoginHandler call

Accounts.registerLoginHandler(function(loginRequest) {
  // ... check loginRequest for proper credentials - up to you 
  var userId = something; // determined by the credentials check

  // add a resume token so that Meteor can resume your session on reconnect
  var stampedToken = Accounts._generateStampedLoginToken();
  Meteor.users.update(session.user, 
    {$push: {'services.resume.loginTokens': stampedToken}});

  return {
    id: userId,
    token: stampedToken.token
  });

3: Call login on the client

var loginRequest = { ... your auth credentials ... };
Accounts.callLoginMethod({
  methodArguments: [loginRequest],
  userCallback: function (err) {
      if (!err) {  ... do stuff here on successful login ...  }
  }});

That's it!