title: Authentication without Passport
body: <p>I'm using active directory to authenticate users, so I thought I didn't need to use Passport and that all I would need to do is after the password checks out is to create a global(?) boolean with res.locals to indicate that the user has been authenticated.  </p>
  
  <p>I've tried something like this in a controller function:</p>
  
  <pre><code>ad.authenticate(username,password, function(err,auth) {
  
      //some of the things I tried unsuccessfully -- should be true after logged in
      res.locals.auth = auth
      app.locals.auth = auth //app not defined 
  
  })
  </code></pre>
  
  <p>However, I've discovered that when I call a later function checking if the user is logged in as part of middleware for a diff route, res.locals.auth and app.locals.auth are either false or undefined.  I've tried setting both vars in my server.js file at the beg with the code below but that didn't work either...</p>
  
  <pre><code> app.use((req, res, next) =&gt; {
    app.locals.auth = false;
    res.locals.auth = false;
    next();
  });
  </code></pre>
  
  <p>So my question is, what var/where should I be saving the authenticated status?  Or should I just use passport instead because there's some security concern that I was unaware of?  What is the point of the isMemberOf in passport setup example?<br>
  <a href="https://www.npmjs.com/package/passport-activedirectory" rel="nofollow noreferrer">https://www.npmjs.com/package/passport-activedirectory</a> </p>
  
  <p>All I want to do is just check user credentials and basically recreate req.isAuthenticated in Passport because I couldn't figure out how to use it because of the isMemberOf. </p>