This blog post will guide you through the custom authentication flow with examples of how to implement the App Server code and the mobile app code. An OpenLDAP<\/a> server is used in this example, but the flow applies to any external authentication provider.<\/p>\n The example App Server is a simple node.js application and the mobile app code samples use the Couchbase Lite Android SDK<\/a>.<\/p>\n This blog assumes familiarity with Couchbase Server, Sync Gateway, and Couchbase Lite.<\/p>\n You will need an operational Sync Gateway 2.5 & Couchbase Server EE 6.x installation. If needed, the following links can get you up and running quickly:<\/p>\n All code from this blog is available in the following Git repository: https:\/\/github.com\/dugbonsai\/sg-custom-auth<\/a><\/p>\n The following diagram shows an example of custom authentication.<\/p>\n If you already have an LDAP server configured you can skip this section. If you do not have an LDAP server configured, these instructions will walk you through configuring OpenLDAP on Ubuntu 18.04<\/a>.<\/p>\n You will see the information for mobileuser:<\/p>\n The App Server is implemented as a node.js application. The full App Server code is available in auth.js<\/a> in the following Git repository: sg-custom-auth<\/a>. The App Server uses the passport-ldapauth package<\/a> for LDAP authentication. The following code snippets highlight the call to authenticate against the OpenLDAP server and the Sync Gateway REST API calls.<\/p>\n The App Server must handle calls to POST \/login. This endpoint is called from the mobile app with the user credentials stored in the request body in username and password. The App Server uses these credentials to authenticate against the OpenLDAP server.<\/p>\n The value of searchBase must match the domain components defined in your LDAP server. dc=example,dc=com was used above so the same values are used here (line 12).<\/p>\n The following steps will be executed if the user is authenticated.<\/p>\n Get user information from Sync Gateway by calling GET \/{db}\/_user\/{name}<\/a>. If the user exists in Sync Gateway, the response code is 200. If the user does not exist in Sync Gateway, the response code is 404.<\/p>\n Create a new user in Sync Gateway by calling POST \/{db}\/_user\/<\/a>. If the user was successfully created in Sync gateway, the response code is 201.<\/p>\n Create a session for the user in Sync Gateway by calling POST \/{db}\/_session<\/a>. In this example, the session will expire after 30 minutes. If the session was successfully created in Sync Gateway, the response code is 200. The JSON response contains the following values:<\/p>\n session_id<\/strong>: the ID for the new session. This will be used by the mobile app for authentication with Sync Gateway.<\/p>\n expires<\/strong>: timestamp when the session expires. This is not used in the mobile app.<\/p>\n cookie_name<\/strong>: name of the session cookie. This is not used in the mobile app.<\/p>\n To test the authentication from the App Server, start it using the following command:<\/p>\n After it starts you will see the following:<\/p>\n You can test the app server using a simple curl command as follows (or Postman, etc.):<\/p>\n You will see output similar to the following:<\/p>\n If the user does not exist in LDAP, the response will be:<\/p>\n The output from the App Server will look like this:<\/p>\n All that is left to do is make the appropriate calls from the Mobile App to the App Server and Sync Gateway. The mobile app uses the Volley framework<\/a> to make the REST call to the App Server. The following code snippets highlight the call to the App Server and the Couchbase Lite code to authenticate using the session_id.<\/p>\n Authenticate user with App Server by calling POST \/login\/<\/p>\n Create one-shot replication using saved session_id (line 13) and re-authenticate if Sync Gateway session has expired.<\/p>\n If you’re new to Couchbase, take advantage of our free, online training available at https:\/\/learn.couchbase.com<\/a> to learn more.<\/p>\n More mobile tutorials<\/a> can be found on the Couchbase Tutorials web page<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Custom Authentication with Couchbase Mobile Couchbase Mobile extends Couchbase to the edge, securely managing and syncing data from any cloud to every mobile device. Couchbase Mobile features an embedded database \u2013 Couchbase Lite \u2013 with SQL and full-text search for […]<\/p>\n","protected":false},"author":1352,"featured_media":7527,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[2370,1815,1810,1822,1813,2366],"tags":[],"ppma_author":[9091],"class_list":["post-7526","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android","category-best-practices-and-tutorials","category-couchbase-mobile","category-node-js","category-security","category-sync-gateway"],"acf":[],"yoast_head":"\nPrerequisites<\/h2>\n
\n
Custom Authentication Flow<\/h2>\n
![\"\"](\"https:\/\/www.couchbase.com\/blog\/wp-content\/uploads\/2019\/08\/SG-Custom-Auth-Flow.jpg\")
<\/p>\n\n
OpenLDAP Configuration<\/h2>\n
\n
dn: ou=People,dc=example,dc=com\r\nobjectClass: organizationalUnit\r\nou: People\r\n\r\ndn: ou=Groups,dc=example,dc=com\r\nobjectClass: organizationalUnit\r\nou: Groups\r\ndn: cn=department,ou=Groups,dc=example,dc=com\r\nobjectClass: posixGroup\r\ncn: subgroup\r\ngidNumber: 5000\r\n\r\ndn: uid=mobileuser,ou=People,dc=example,dc=com\r\nobjectClass: inetOrgPerson\r\nobjectClass: posixAccount\r\nobjectClass: shadowAccount\r\nuid: mobileuser\r\nsn: User\r\ngivenName: Mobile\r\ncn: Mobile User\r\ndisplayName: mobileuser\r\nuidNumber: 10000\r\ngidNumber: 5000\r\nuserPassword: password\r\ngecos: Mobile User\r\nloginShell: \/bin\/bash\r\nhomeDirectory: \/home\/mobileuser<\/pre>\n
\n
$ ldapadd -x -D cn=admin,dc=example,dc=com -W -f ldap_data.ldif<\/pre>\n
\n
$ ldapsearch -x -LLL -b dc=example,dc=com 'uid=mobileuser'<\/pre>\n
dn: uid=mobileuser,ou=People,dc=example,dc=com\r\nobjectClass: inetOrgPerson\r\nobjectClass: posixAccount\r\nobjectClass: shadowAccount\r\nuid: mobileuser\r\nsn: User\r\ngivenName: Mobile\r\ncn: Mobile User\r\ndisplayName: mobileuser\r\nuidNumber: 10000\r\ngidNumber: 5000\r\ngecos: Mobile User\r\nloginShell: \/bin\/bash\r\nhomeDirectory: \/home\/mobileuser<\/pre>\n
App Server Implementation<\/span><\/h2>\n
var express = require('express'),\r\n passport = require('passport'),\r\n bodyParser = require('body-parser'),\r\n LdapStrategy = require('passport-ldapauth'),\r\n curl = require('curl-request');\r\n\r\nvar syncGatewayEndpoint = 'https:\/\/<Sync Gateway Host>:4985\/<db>';\r\nvar app = express();\r\nvar OPTS = {\r\n server: {\r\n url: 'ldap:\/\/<OpenLDAP Host>:389',\r\n searchBase: 'dc=example,dc=com', \/\/ MUST match LDAP directory\r\n searchFilter: '(uid={{username}})'\r\n }\r\n};\r\n\r\npassport.use(new LdapStrategy(OPTS));\r\napp.use(bodyParser.json());\r\napp.use(bodyParser.urlencoded({extended: false}));\r\napp.use(passport.initialize());\r\n\r\napp.post('\/login', passport.authenticate('ldapauth', {session: false}), function(req, res) {\r\n \/\/ user successfully authenticated against LDAP\r\n}<\/pre>\nGet user information from Sync Gateway<\/h4>\n
getUser = new(curl);\r\ngetUser.setHeaders(['Content-Type: application\/json'])\r\n .get(syncGatewayEndpoint + '\/_user\/' + req.body.username)\r\n .then(({statusCode, body, headers}) => {\r\n if (statusCode == 404) {\r\n \/\/ status == 404: user does not exist\r\n } else if (statusCode == 200) {\r\n \/\/ status == 200: user exists\r\n }\r\n })<\/pre>\nIf the user does not exist in Sync Gateway, create a new user<\/h4>\n
postUser = new(curl);\r\npostUser.setHeaders(['Content-Type: application\/json'])\r\n .setBody('{\"name\": \"' + req.body.username + '\",\"password\": \"' + req.body.password + '\"}')\r\n .post(syncGatewayEndpoint + '\/_user\/')\r\n .then(({statusCode, body, headers}) => {\r\n if (statusCode == 201) {\r\n \/\/ status == 201: success\r\n } else {\r\n \/\/ user could not be created\r\n }\r\n })<\/pre>\nCreate a session for the user in Sync Gateway<\/h4>\n
resBody = {statusCode: 200};\r\npostSession = new(curl);\r\npostSession.setHeaders(['Content-Type: application\/json'])\r\n .setBody('{\"name\": \"' + request.body.username + '\",\"ttl\": 1800}')\r\n .post(syncGatewayEndpoint + '\/_session')\r\n .then(({statusCode, body, headers}) => {\r\n if (statusCode == 200) {\r\n \/\/ status == 200: success\r\n resBody.session_id = body.session_id;\r\n resBody.expires = body.expires;\r\n resBody.cookie_name = body.cookie_name;\r\n\r\n \/\/ send success response back to client\r\n response.send(JSON.stringify(resBody));\r\n } else {\r\n \/\/ session could not be created\r\n }\r\n })<\/pre>\nTesting Authentication<\/span><\/h2>\n
$ node auth.js<\/pre>\n
Listening on port 8080<\/pre>\n
$ curl -d \"username=mobileuser&password=password\" -X POST https:\/\/<AppServer host>:8080\/login<\/pre>\n
{\"statusCode\":200,\"session_id\":\"c149012eaa8d0cf15b1b4110cf0a2fec259ef726\",\"expires\":\"2019-08-01T13:47:56.311076773Z\",\"cookie_name\":\"SyncGatewaySession\"}<\/pre>\nUnauthorized<\/pre>\n
mobileuser has been authenticated with LDAP\r\ncreating user mobileuser in Sync Gateway\r\nuser mobileuser created in Sync Gateway\r\ncreate session for user mobileuser\r\ncreated session for mobileuser<\/pre>\n
Mobile App Implementation<\/span><\/h2>\n
Authenticate mobile user<\/h4>\n
JSONObject reqBody = new JSONObject();\r\nreqBody.put(\"username\", <user supplied username>);\r\nreqBody.put(\"password\", <user supplied password>);\r\n\r\nString url = <App Server host>:8080\/login;\r\nRequestQueue queue = Volley.newRequestQueue(<context>);\r\nJsonRequest<JSONObject> jsonRequest = new JsonObjectRequest(\r\n Request.Method.POST,\r\n url,\r\n reqBody,\r\n new Response.Listener<JSONObject>() {\r\n @Override\r\n public void onResponse(JSONObject response) {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/ get session_id from response\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 try {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 String sessionID = response.getString(\"session_id\");\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/ Store session_id\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 } catch (JSONException je) {\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/ Handle exception\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }\r\n }\r\n },\r\n new Response.ErrorListener() {\r\n @Override\r\n \u00a0\u00a0\u00a0\u00a0\u00a0 public void onErrorResponse(VolleyError error) {\r\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/ authentication failed\r\n }\r\n });\r\n\r\nqueue.add(jsonRequest);<\/pre>\nCreate one-shot replication<\/h4>\n
String syncGatewayEndpoint = \"ws:\/\/<Sync Gateway Host>:4984\/{db}\";\r\nURI url = null;\r\ntry {\r\n url = new URI(mSyncGatewayEndpoint);\r\n} catch (URISyntaxException e) {\r\n e.printStackTrace();\r\n return;\r\n}\r\n\r\nReplicatorConfiguration config = new ReplicatorConfiguration(database, new URLEndpoint(url));\r\nconfig.setReplicatorType(ReplicatorConfiguration.ReplicatorType.PUSH_AND_PULL);\r\nconfig.setContinuous(false);\r\nconfig.setAuthenticator(new SessionAuthenticator(sessionID));\r\n\r\nReplicator replicator = new Replicator(config);\r\nreplicator.addChangeListener(new ReplicatorChangeListener() {\r\n @Override\r\n\u00a0\u00a0\u00a0\u00a0 public void changed(ReplicatorChange change) {\r\n CouchbaseLiteException error = change.getStatus().getError();\r\n if (error != null) {\r\n if (error.getCode() == 10401) {\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \r\n \/\/ session expired; re-authenticate\r\n }\r\n }\u00a0\r\n\r\n ...\r\n }\r\n});\r\nreplicator.start();<\/pre>\nWhat\u2019s Next<\/h2>\n