With Passport configured, we can now set up the passport-local strategy for authenticating with a username and password.

First, we can configure the local strategy by creating a new instance of it and passing it as middleware into passport:

passport.use(new LocalStrategy(
  function(username, password, done) {
    // …
  }
));

The new LocalStrategy object will take in an anonymous function with the following parameters:

• username
• password
• A callback function called done.

The purpose of the done callback is to supply an authenticated user to Passport if a user is authenticated. The logic within the anonymous function follows this order:

1. Verify login details in the callback function.
2. If login details are valid, the done callback function is invoked and the user is authenticated.
3. If the user is not authenticated, pass false into the callback function.

The done callback function takes in two arguments:

• An error or null if no error is found.
• A user or false if no user is found.

With those steps implemented our updated strategy should look like:

passport.use(new LocalStrategy(
  function (username, password, done) {
    // Look up user in the db
    db.users.findByUsername(username, (err, user) => {
      // If there's an error in db lookup, 
      // return err callback function
      if(err) return done(err);

      // If user not found, 
      // return null and false in callback
      if(!user) return done(null, false);

      // If user found, but password not valid, 
      // return err and false in callback
      if(user.password != password) return done(null, false);

      // If user found and password valid, 
      // return the user object in callback
      return done(null, user)
    });
  })
);

We’re looking for potential errors during the authentication process and addressing them before the next request handler is reached.

Once the local strategy is configured, the Express application will have user authentication implemented!