How to authenticate a user when the "username" field receives values that can reference different columns in the database table?

Question

I have a login form where I have the fields "username" and "password". The difficulty I have been finding is the following: I want to give the option of the user to log in by CPF, email or phone (in the "username" field). Since in the Attempt() method of the Auth() class, which I use to authenticate, I can only pass values that reference fixed columns. See how my code is in the login method:

public function login(Request $request){
      $array = ["error" => ''];
    
      $username = $request->input('username'); //Será passado o email,cpf ou telefone
      $password = $request->input('password');
    
      if($user && $password){
    
        $token = Auth()->attempt(['email' => $username, 'password' => $password]);
    
        if(!$token){
          return $this->unauthorized();
        }
        
        $array['token'] = $token;
      }
  }

Above, that $username variable can be Cpf, email, or phone (which are distinct columns from the users table).

In short, I want to give the opportunity for the user to log in with the option he wants between these 3 (Cpf, email and phone).

Roughly, just to illustrate my need, it would be something like this:

$token = Auth()->attempt(['email/cpf/phone' => $username, 'password' => $password]);

Could you help me with that ? If I am not clear, let us know in the comments that I edit and add information.

OBS: I’m wearing Laravel 7.

Answer 1

I needed to customize a login query in a work project and figured out how to do it. The process is undocumented and needs to read enough code to understand in detail how it works. The solution is simple: overwrite the method EloquentUserProvider::retrieveByCredentials, the original method has a $query where you can make your business rule with conditions orWhere.

For this you need to follow a few steps:

1. Create a class that extends \Illuminate\Auth\EloquentUserProvider (in this example MeuEloquentUserProvider;
2. Overwrite the method retrieveByCredentials according to your need;
3. Inform the framework to use the custom class MeuEloquentUserProvider in the method register of some service Provider, recommend the \App\Providers\AuthServiceProvider:

use \Illuminate\Auth\AuthManager;

public function register()
{
    $this->app->extend(AuthManager::class, function(AuthManager $manager) {
        return $manager->provider('eloquent', function($app, $config) {
            return new MeuEloquentUserProvider($app['hash'], $config['model']);
        });
    });
}

The related methods are:

• \Illuminate\Container\Container::extend
• \Illuminate\Auth\AuthManager::provider

Answer 2

I made a customization (a separate method) that checks whether the data, which the user used to try to log in, matches one of the database columns (email, Cpf or phone). See this method that has been created:

public function verifyLogin($user){
        
   $u = User::where('email', $user)->orWhere('cpf', $user)->orWhere('phone',$user)->first()->toArray();
     
   if($u)
   {
     return  $u;
   }

   return false;
}

If one of the data matches, the user data is returned and in the Auth Attempt() method, we use the id of that user that was found to log in. See how the code looks in the login() method, which is the method that authenticates.

public function login(Request $request){

       $array = ["error" => ''];

       $username = $request->user; //Será passado o email,cpf ou telefone
       $password = $request->password;

    if($username && $password){

       //Chamando método para verificar o tipo de login
       $data = $this->verifyLogin($username);

          
       if(!$data)
       {
           $array["error"] = "Dados Inválidos";
           return $array;
       }

       $token = Auth()->attempt(['id' => $data['id'], 'password' => $password, 'is_active' => 1]);

       if(!$token){
          return $this->unauthorized();
       }

          
       $array['token'] = $token;
       
       $user = User::select('id', 'name', 'surname', 'email', 'internal_client_id', 'is_client','is_client_employee',
       'permission_id','is_active','is_spreadsheet')->where('id', '=', $data['id'])->get();
           
        $array['userData'] = $user;

        return $array;

   }else{
      $array = ["error" => 'Dados não enviados'];
   }

   return $array;
}

OBS: In my case, this logic was applied taking into account that the fields are "Unique" and that they are not mandatory.

OBS-2: These two methods are within the Authcontroller class.

OBS-3: The Illuminate Support Facades Auth, the Illuminate Http Request and the App Models User are imported into the file for the methods of these classes to be used in the Authcontroller class.