Get authenticated user with Laravel Passport and grant password

Question

I did an API REST with Laravel and now I'm trying to consume it. The thing is I need to authenticate users in the API and I am using the Password Grant method. I can authenticate users correctly and I can get an access token but from then, I don't see a way to retrieve the authenticated user with the access token in my consuming application.

I tried in the API with a route like this:

Route::get('/user', function(Request $request) {     $user = $request->user();     // Even with     $user = Auth::user();      return $user; }); 

No dice. I am reading Passport code but I can't figure it out. My guess is that I would need to specify a new guard type or something because It doesn't seem that Laravel Passport provides one for this kind of grant type...

To clarify things:

• I have an API REST application, which is the oAuth2 Server.
• I have another application consuming the API REST.
• I do know the workflow. In my case, with Password Grant, I get the user credentials in my consumer application, then I make a request to /oauth/token specifying the grant_type to password, I provide the user credentials along with my client credentials, which I am sure they were generated with "php artisan passport:client --password" (note the --password option)
• I can get the access token with no problems. What I need now, is to get a JSON representation of the user I just authenticated from the API REST. But here is the problem: I just have an access token. Nothing I can relate with the user.

Or can I? Maybe I can extend the method that authenticates password grant requests to relate the generated access token to the user it is authenticating... *light bulb turns on*

Consuming application test code:

try {     $client = new Client();     $result = $client->post('https://myapi.com/oauth/token', [         'form_params' => [             'grant_type' => 'password',             'client_id' => '5',             'client_secret' => 'my_secret',             'username' => 'user_I_am_authenticating',             'password' => 'the_user_password',             'scope' => '',         ]     ]);     $access_token = json_decode((string) $result->getBody(), true)['access_token'];     $result = $client->get('https://myapi.com/client/user', [         'headers' => [             'Content-Type' => 'application/json',             'Accept' => 'application/json',             'Authorization' => "Bearer $access_token",         ]     ]);      return (string) $result->getBody(); } catch (GuzzleException $e) {     return "Exception!: " . $e->getMessage(); } 

Note that https://myapi.com/client/user route is just a route I made for testing in the API. That route is defined as:

Route::get('/user', function(Request $request) {     return $request->user(); }); 

Now. I know this is not working. This is what I want to achieve. Know the user making the request given the access_token/bearer_token.

Answer 1

You forgot the appropriate middleware.

Route::get('/user', function(Request $request) {     return Auth::user(); })->middleware('auth:api'); 

The authentication flow is not fired when you don't mention the auth middleware. That's why you get null.