title: Can I put and retrieve the user information to and from session into a Laravel custom user provider?
body: <p>I am not so into <strong>PHP</strong> and <strong>Laravel</strong> and I have the following problem, I came from Java.</p>
  
  <p>I am following this tutorial to implement a <strong>custom user provider</strong>:</p>
  
  <p><a href="https://blog.georgebuckingham.com/laravel-52-auth-custom-user-providers-drivers/" rel="nofollow noreferrer">https://blog.georgebuckingham.com/laravel-52-auth-custom-user-providers-drivers/</a></p>
  
  <p>I am using Laravel 5.3 version.</p>
  
  <p>I briefly expain what I need: my Laravel application is only a front end application, all the business logic, included the user authentication, is performed by a Java back end application that exposes REST web services.</p>
  
  <p>Performing a call to:</p>
  
  <pre><code>http://localhost:8080/Extranet/login
  </code></pre>
  
  <p>and passing <strong>username</strong> and <strong>password</strong> as basic authentication I obtain a <strong>JSON</strong> response like this that represent the logged user:</p>
  
  <pre><code>{
    "userName": "Painkiller",
    "email": "painkiller@gmail.com",
    "enabled": true
  }
  </code></pre>
  
  <p>So, in my Laravel application, I have to perform this call and then parse the previous returned JSON object to generate the authenticated object into the front end application session.</p>
  
  <p>To do this I have implemented the previous tutorial (and it seems to works) implementing this <strong>custom user provider</strong> class named <strong>UserProvider</strong> that implements the Laravel <strong>IlluminateUserProvider</strong> interface:</p>
  
  <pre><code>&lt;?php
  
  namespace App\Authentication;
  
  use Illuminate\Auth\GenericUser;
  use Illuminate\Contracts\Auth\Authenticatable;
  use Illuminate\Contracts\Auth\UserProvider as IlluminateUserProvider;
  use GuzzleHttp\Client;
  use function GuzzleHttp\json_encode;
  use function GuzzleHttp\json_decode;
  use Illuminate\Support\Facades\Log;
  
  class UserProvider implements IlluminateUserProvider
  {
      public function retrieveById($identifier)
      {
          // TODO: Implement retrieveById() method.
          \Log::info('retrieveById START');
  
          // PERFORM THE CALL TO MY BACK END WB SERVICE AND CREATE A NEW GenericUser USING THESE INFORMATION:
  
          $attributes = array(
              'id' =&gt; 123,
              'username' =&gt; 'nobili.andrea@gmail.com',
              'password' =&gt; \Hash::make('SuperSecret'),
              'name' =&gt; 'Dummy User',
          );
  
          $user = new GenericUser($attributes);
  
          return $user;
  
      }
  
      public function retrieveByToken($identifier, $token)
      {
          // TODO: Implement retrieveByToken() method.
          \Log::info('retrieveByToken START');
      }
  
      public function updateRememberToken(Authenticatable $user, $token)
      {
          // TODO: Implement updateRememberToken() method.
          \Log::info('updateRememberToken START');
      }
  
      public function retrieveByCredentials(array $credentials) {
  
          // TODO: Implement retrieveByCredentials() method.
  
          \Log::info('retrieveByCredentials START');
          \Log::info('INSERTED USER CREDENTIAL: '.$credentials['email'] . ' ' .$credentials['password']);
  
          $client = new Client(); //GuzzleHttp\Client
  
          $response = $client-&gt;get('http://localhost:8080/Extranet/login',
              [
                  'auth' =&gt; [
                      'nobili.andrea@gmail.com',
                      'pswd'
                  ]
              ]);
  
          $dettagliLogin = json_decode($response-&gt;getBody());
  
          \Log::info('response: '.(json_encode($dettagliLogin)));
  
          //$user = new User('Pippo', 'pippo@google.com', true);
  
          $attributes = array(
              'id' =&gt; 123,
              'username' =&gt; 'nobili.andrea@gmail.com',
              'password' =&gt; \Hash::make('SuperSecret'),
              'name' =&gt; 'Dummy User',
          );
  
          $user = new GenericUser($attributes);
  
          \Log::info('USER: '.(json_encode($user)));
  
          return $user;
  
  
      }
  
      public function validateCredentials(Authenticatable $user, array $credentials)
      {
          // TODO: Implement validateCredentials() method.
          \Log::info('validateCredentials START');
          return true;
      }
  
  }
  </code></pre>
  
  <p>This is only a preliminary test so the returned data are mocked.</p>
  
  <p>It works in this way:</p>
  
  <p>1) When the user insert his credential in the login page (<a href="http://localhost:8000/login" rel="nofollow noreferrer">http://localhost:8000/login</a>) it is called the <strong>retrieveByCredentials()</strong> method:</p>
  
  <pre><code>public function retrieveByCredentials(array $credentials) {
  
      // TODO: Implement retrieveByCredentials() method.
  
      \Log::info('retrieveByCredentials START');
      \Log::info('INSERTED USER CREDENTIAL: '.$credentials['email'] . ' ' .$credentials['password']);
  
      $client = new Client(); //GuzzleHttp\Client
  
      $response = $client-&gt;get('http://localhost:8080/Extranet/login',
          [
              'auth' =&gt; [
                  'nobili.andrea@gmail.com',
                  'pswd'
              ]
          ]);
  
      $dettagliLogin = json_decode($response-&gt;getBody());
  
      \Log::info('response: '.(json_encode($dettagliLogin)));
  
      //$user = new User('Pippo', 'pippo@google.com', true);
  
      $attributes = array(
          'id' =&gt; 123,
          'username' =&gt; 'nobili.andrea@gmail.com',
          'password' =&gt; \Hash::make('SuperSecret'),
          'name' =&gt; 'Dummy User',
      );
  
      $user = new GenericUser($attributes);
  
      \Log::info('USER: '.(json_encode($user)));
  
      return $user;
  
  }
  </code></pre>
  
  <p>that performs a web service call to obtain the user information related to this user. Then these credential are verified by the <strong>validateCredentials()</strong> method (at this time it returns <strong>true</strong> every time). Finnaly it returns a <strong>GenericUser</strong> objct containing the information of the logged user (at this time are mocked because is a test and I have not yet paresed the <strong>JSON</strong> reeturned by my web service.</p>
  
  <p>Then, when the user access to the next page (after the success login) it seems to me that is called the <strong>retrieveById($identifier)</strong> method, this:</p>
  
  <pre><code>public function retrieveById($identifier)
  {
      // TODO: Implement retrieveById() method.
      \Log::info('retrieveById START');
  
      // PERFORM THE CALL TO MY BACK END WB SERVICE AND CREATE A NEW GenericUser USING THESE INFORMATION:
  
      $attributes = array(
          'id' =&gt; 123,
          'username' =&gt; 'nobili.andrea@gmail.com',
          'password' =&gt; \Hash::make('SuperSecret'),
          'name' =&gt; 'Dummy User',
      );
  
      $user = new GenericUser($attributes);
  
      return $user;
  
  }
  </code></pre>
  
  <p>At this time the logic is that it use the id of the previous logged user to perform a call to the back end web service, obtain again these information and create the same <strong>GenericUser</strong> object that will be returned to the next page that uses it. Now I have mock these userinformation.</p>
  
  <p>Ok, this works but I can't do in this way for security reason.</p>
  
  <p>So my idea is: when I retrieve the user information in the <strong>retrieveByCredentials(array $credentials)</strong>, after have check that are correct, I will put this <strong>GenericUser</strong> object into session.</p>
  
  <p>Then in the <strong>retrieveById()</strong> method I will retrieve these information from the session.</p>
  
  <p>Can I do something like this? Could be a smart way? How can I put and retrieve an object\data into and from the session (I am not into PHP and front end).</p>