title: Using JWT for Loopback authentication
body: <p>I'm trying to understand how I can fit a custom JWT routing into loopbacks security model. My application has an authentication "dance" involving SMS that results in a valid JWT token using the <a href="https://jwt.io/introduction/" rel="noreferrer">excellent description</a>. I'm using the <a href="https://www.npmjs.com/package/jsonwebtoken" rel="noreferrer">jsonwebtoken</a> and things work as expected. After obtaining the token my angular.js client sends the token with each request in the <code>Authorisation: JWT ..token..</code> header (found conflicting documentation, one says JWT, one Bearer, but I can figure that out).</p>
  
  <p>Now I want to make use of the token inside a loopback application. I'd like to use the ACL system loopback provides. I did read the following resources:</p>
  
  <ul>
  <li><a href="https://scotch.io/tutorials/authenticate-a-node-js-api-with-json-web-tokens" rel="noreferrer">Authenticate a Node.js API with JSON Web Tokens</a></li>
  <li><a href="https://docs.strongloop.com/display/public/LB/Logging+in+users" rel="noreferrer">Loopback, loggin in users</a></li>
  <li><a href="https://docs.strongloop.com/pages/releaseview.action?pageId=3836277" rel="noreferrer">Third-party login (Passport)</a></li>
  <li><a href="https://docs.strongloop.com/display/public/LB/Making+authenticated+requests" rel="noreferrer">Loopback, making authenticated requests</a></li>
  <li><a href="https://github.com/themikenicholson/passport-jwt" rel="noreferrer">Passport strategy for JWT</a></li>
  <li><a href="https://github.com/strongloop/loopback-component-oauth2/blob/master/lib/oauth2-loopback.js" rel="noreferrer">Loopback OAuth2.0 source</a></li>
  <li><a href="https://github.com/cosmojs/loopback-satellizer" rel="noreferrer">Loopback satelizer</a></li>
  </ul>
  
  <p>And I'm not clear what my next steps are. I have working:</p>
  
  <ul>
  <li>User 'login' - generating a JWT</li>
  <li>User login using username/password (to be retired)</li>
  <li>Working ACL implementation in loopback (when I access an ACL protected resource I get, as expected a 4xx error)</li>
  <li>My JWT token properly (?) in the  header of the request</li>
  </ul>
  
  <p>I need:</p>
  
  <ul>
  <li>based on the JWT token a valid user with roles compatible to loopback ACL</li>
  </ul>
  
  <p>Help is very much appreciated</p>