How to Implement Multi-Authentication System in Laravel

In modern web applications, authentication is crucial for securing user data and managing user access. Laravel, a popular PHP framework, simplifies authentication with built-in tools. However, in many applications, you may need to manage different types of users, each with their own access levels and permissions. This is where a multi-authentication system comes into play.

A multi-authentication system allows you to authenticate various user types, such as admins, regular users, and managers, each with different roles and privileges. In this guide, we’ll walk through the steps to build a multi-authentication system in Laravel, providing detailed explanations to help beginners understand each part of the process.

Why Build a Multi-Authentication System?

• User Role Management: Different users may need different levels of access. For example, admins should have access to all areas, while regular users may only access their data.
• Enhanced Security: By segregating user types, you can implement specific security measures for different roles.
• Flexibility: Multi-authentication systems offer flexibility in managing user access and permissions, making it easier to scale and adapt your application as needed.

Prerequisites

Before we begin, ensure you have the following:

• Basic Knowledge of Laravel: Familiarity with Laravel’s routing, controllers, and authentication basics.
• A Laravel Project: You should have a Laravel project set up. If not, you can create one using the Laravel installer or Composer.

Step 1: Set Up Your Laravel Project

If you haven’t already, set up a new Laravel project. Open your terminal and run:

composer create-project --prefer-dist laravel/laravel multi-auth-app
cd multi-auth-app

Step 2: Install Laravel Breeze

Laravel Breeze is a simple authentication package that provides a great starting point for adding authentication features. Install it using Composer:

composer require laravel/breeze --dev

Next, publish the Breeze scaffolding and run the migration:

php artisan breeze:install
php artisan migrate

Step 3: Create User Models and Migrations

We need to define multiple user types. For simplicity, let’s consider two user types: Admin and User. We’ll start by creating separate models and migrations for these user types.

Run the following commands to create models and migrations:

php artisan make:model Admin -m
php artisan make:model User -m

Modify the migrations for admins and users tables:

Here is how the CreateAdminsTable Migration should look like:

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

class CreateAdminsTable extends Migration
{
    public function up()
    {
        Schema::create('admins', function (Blueprint $table) {
            $table->id();
            $table->string('name');
            $table->string('email')->unique();
            $table->string('password');
            $table->timestamps();
        });
    }

    public function down()
    {
        Schema::dropIfExists('admins');
    }
}>

And here is how the CreateUsersTable Migration should look like:

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

class CreateUsersTable extends Migration
{
    public function up()
    {
        Schema::create('users', function (Blueprint $table) {
            $table->id();
            $table->string('name');
            $table->string('email')->unique();
            $table->string('password');
            $table->timestamps();
        });
    }

    public function down()
    {
        Schema::dropIfExists('users');
    }
}>

Run the migrations:

php artisan migrate

Step 4: Set Up Authentication Guards

Laravel uses guards to define how users are authenticated. We need to configure guards for admin and user roles.

Open config/auth.php and add new guards for admin and user:

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'admin' => [
        'driver' => 'session',
        'provider' => 'admins',
    ],
   
    'api' => [
        'driver' => 'token',
        'provider' => 'users',
        'hash' => false,
    ],
],

Add providers for these guards:

'providers' => [
    'users' => [
        'driver' => 'eloquent',
        'model' => App\Models\User::class,
    ],

    'admins' => [
        'driver' => 'eloquent',
        'model' => App\Models\Admin::class,
    ],
],

Step 5: Create Authentication Controllers

We need separate controllers to handle authentication for admins and users. Create these controllers using Artisan:

php artisan make:controller AdminAuthController
php artisan make:controller UserAuthController

In AdminAuthController, add methods for login and logout:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use App\Models\Admin;

class AdminAuthController extends Controller
{
    public function showLoginForm()
    {
        return view('auth.admin_login');
    }

    public function login(Request $request)
    {
        $credentials = $request->only('email', 'password');

        if (Auth::guard('admin')->attempt($credentials)) {
            return redirect()->intended('admin/dashboard');
        }

        return redirect('admin/login')->with('error', 'Invalid credentials');
    }

    public function logout()
    {
        Auth::guard('admin')->logout();
        return redirect('admin/login');
    }
}>

Similarly, add methods in UserAuthController for user authentication.

Step 6: Create Authentication Views

Create the login views for admin and user. Store these in resources/views/auth.

Admin Login View (resources/views/auth/admin_login.blade.php):

<!DOCTYPE html>
<html>
<head>
    <title>Admin Login</title>
</head>
<body>
    <form action="{{ route('admin.login') }}" method="POST">
        @csrf
        <label for="email">Email:</label>
        <input type="email" name="email" required>
        <label for="password">Password:</label>
        <input type="password" name="password" required>
        <button type="submit">Login</button>
    </form>
    @if(session('error'))
        <p>{{ session('error') }}</p>
    @endif
</body>
</html>

Create similar views for users.

Step 7: Define Routes

Add routes for the authentication controllers in routes/web.php:

// Admin Routes
Route::get('admin/login', [AdminAuthController::class, 'showLoginForm'])->name('admin.login.form');
Route::post('admin/login', [AdminAuthController::class, 'login'])->name('admin.login');
Route::post('admin/logout', [AdminAuthController::class, 'logout'])->name('admin.logout');

// User Routes
Route::get('login', [UserAuthController::class, 'showLoginForm'])->name('user.login.form');
Route::post('login', [UserAuthController::class, 'login'])->name('user.login');
Route::post('logout', [UserAuthController::class, 'logout'])->name('user.logout');

Step 8: Test the Multi-Authentication System

Now, test the multi-authentication system by accessing the login pages for both admins and users. Ensure that each type of user can log in and access their respective areas.

Usage Benefits

Implementing a multi-authentication system in your Laravel application provides several advantages that enhance both usability and security. By segmenting user types, you can ensure that each user has access only to the areas and functionalities that are pertinent to their role, thus maintaining order and integrity throughout your application. Below are some key benefits of adopting a multi-authentication system:

• Role-Based Access Control: Easily manage different user roles and permissions. This ensures that admins can perform critical functions while regular users can only access features relevant to their needs, thereby minimizing errors and unauthorized access.
• Enhanced Security: Apply specific security measures for different user types. For instance, admins may require two-factor authentication, while regular users may not, which allows for tailor-made security protocols based on user roles.
• Customizable: Adapt the authentication system to fit various use cases and requirements. Whether you want to add more user types, implement different password policies, or manage unique permissions, a multi-authentication system can be easily modified to suit changing needs.

Overall, the adoption of a multi-authentication system not only enhances the security of your application but also improves the overall user experience by providing a structured environment where users can interact with the system in a way that aligns with their roles. This level of organization is invaluable, especially as your user base grows and diversifies.

Conclusion

Building a multi-authentication system in Laravel is a powerful way to manage different types of users and their access levels. Following this guide, you’ve set up a basic multi-authentication system with separate login processes for admins and regular users. This system can be extended and customized to fit your application’s needs, offering a flexible and secure approach to user management.

Start implementing multi-authentication in your Laravel projects to take full advantage of role-based access and enhanced security features!