If you are using passport-local-mongoose, it will create a salt and hash itself by taking your password. So that's why in your user schema you don't have to save the password field.

But the local strategy for passport-local-mongoose is quite different from normal passport local strategy. It is like

passport.use(new LocalStrategy(User.authenticate()));

This will check the entered password and will check it with the salt and hash.

The code you wrote is for normal local strategy. That should not use if you are using passport-local-mongoose.

This is how you should srialize and desirialize passport-local-mongoose:

 passport.serializeUser(User.serializeUser());passport.deserializeUser(User.deserializeUser());

I assume you have a method for generating the salt and hash before saving.

In your validPassword method, you call the same method and compare the result from the user's password inout and compare it to what you have in the DB/ If it matches, then you are good.

As an alternative, there are libraries to manage this. I use bcrypt. See a sample here:

adminSchema.pre('save', function(next) {
    var user = this;

    // only hash the password if it has been modified (or is new)
    if (!user.isModified('password')) {
        return next();
    }

    // password changed so we need to hash it (generate a salt)
    bcrypt.genSalt(SALT_WORK_FACTOR, function(err, salt) {
        if (err) {
            return next(err);
        }else{
            // hash the password using our new salt
            bcrypt.hash(user.password, salt, function(err, hash) {
                if (err) { return next(err); }
                // override the cleartext password with the hashed one
                user.password = hash;
                next();
            });
        }
    });
});


adminSchema.methods.comparePassword = function(password, cb) {
    console.log('comparing password');
    bcrypt.compare(password, this.password, function(err, isMatch) {
        cb(err, isMatch);
    });
};

Here is an example code.Please note that the User.findOne() function is far from being complete.It's there just for you to see where this code stands with respect to yours and to give you an idea of what changes should be made.

  passport.use('local.signup', new LocalStrategy({
   usernameField:'email', //it can be email or whatever one chooses
   passwordField:'password',
   confirmField:'password',
   passReqToCallback:true//here is the trick.u pass everything you want to do to a callback
   },function (req,email, password, done) {
      req.checkBody('email','Invalid e-mail address...').notEmpty().isEmail().normalizeEmail();//validate email
      req.checkBody('password','Invalid password...').notEmpty().isLength({min:8});//validate pass to be min 8 chars but you can provide it with checking for capital letters and so on and so forth
      var errors = req.validationErrors();
      if(errors){
      var messages = [];
      errors.forEach(function (error) {
      messages.push(error.msg)
     });
    return done(null, false, req.flash('error', messages))
    }

 User.findOne({ email: req.body.email }, function (err, user) {

// Make sure user doesn't already exist
   if (user) return done(null, false, {message:'The email address you have 
   entered is already associated with another account.'
  });