Disable auth completely?

[onionhammer]

If Payload is hosted somewhere which is already auth'd, are there any examples/guidance on how to simply 'turn off' the built in auth?

I've googled, but most of the answers I can find are just around plugging in different strategies (with no samples), and steering people towards "enterprise" offerings.

[DanRibbens]

What you are looking for is auth.disableLocalStrategy.

https://payloadcms.com/docs/authentication/config#options

[onionhammer]

Yes, I've done that and now the admin is just a blank page with no content

[DanRibbens]

I think the only other thing you need is to add your own auth middleware function that sets the user object on req.user. That way the default access control will allow everything to go through. You can add it directly to express.

Payload doesn't care what the user is, could even be an empty object as long as it's not null. You will want to have your users collection set. req.collection: 'users' for example.

[onionhammer]

I'm not seeing this documented on the site anywhere; am I missing it? By "req.collection: 'users'" is that a settings in Users collection, the payload config, or the express server somewhere?

[onionhammer]

Okay, updated server.ts

const app = express();

app.use((req, res, next) => {
  req.user = { 
    id: "Anonymous",
  };

  next();
});

payload.config.ts

export default buildConfig({
  ...
  admin: {
    user: Users.slug,
  },
  collections: [
    Users,
  ]
});

Users.ts

const Users: CollectionConfig = {
  slug: 'users',
  auth: {
    disableLocalStrategy: true,
  },
  admin: {
    useAsTitle: 'email',
    group: "Global",
  },
  access: {
    read: () => true,
  },
  fields: [
    // Email added by default
    // Add more fields as needed
  ],
};

I now see a blank screen on localhost:3000/admin, /api/users/me is a pending network request that never completes

[robaetem]

BUUUUMP

[robaetem]

I use my custom authentication for logging/registering users into my website and put disableLocalStrategy: true on my Users collection. How to make sure I can still access my /admin panel, because by setting disableLocalStrategy, my /admin/login page became blank.

[robaetem]

I managed to solve this issue this way:

My problem

I want to enable my users (defined by Users collection) to log in using Google, Facebook, ... For this, I implemented my own authentication/authorization logic and put disableLocalStrategy: true in my Users collection to disable Payload authentication/authorization. This caused the login page of the /admin panel to be blank (and not show any email/password for logging in).

Solution

Create a new collection (Admins). And use that collection to log in into the admin panel. On this collection, I didn't put disableLocalStrategy: true, thus I can use this collection to log in into the admin panel.