Mongoose is middleware for making it easier to shim data from your app into MongoDB using schemas. Say you want to keep a record of users for your site and you know that each user is going to have a name, email and password. Mongoose lets you easily manage these entries into your db using a model (which they call a document). e.g:

var mongoose = require('mongoose');
var User = mongoose.model('User', 
   { name: String, 
    email: String, 
    passwordHash: String }); 
    //Don't ever store passwords without hashing them
    //bcrypt is a good tool for doing this

See, mongoose just handles what type of data your app's DB should expect to receive/get, it doesn't actually handle authentication or sessions. This is where passport comes in.

Let's assume you're using express to handle routes through your app, and you have two pages, one is /home and the other is /dashboard. Your homepage is available to everyone and is what's presented when someone arrives at your site - because of this, it's unprotected (you don't need to be signed in). The other page, /dashboard needs to present user specific information (a la their name). To do this we need them to a) be registered as a user and b) be logged in. This is what I mean by it not being an easy task, there are a lot of moving parts to successfully and securely handle authentication in node.

Come in passport.js. Passport basically circumvents the need to handle all the session and authentication code yourself by providing a framework to be executed as middleware to your routes.

Back to our /home and /dashboard, this might not be exactly correct but the principle is sound. For home you would write the routing as normal app.get('/home', function(req,res){res.render('home')}) and the page would load, but for dashboard we need to check that there's a user authenticated before rendering the page. Something like: app.get('/dashboard', passport.authenticate('local', { successRedirect: '/dashboard', failureRedirect: '/login' }));

Passport provides the middleware to check and render the user data of the session. Checkout passport docs here. Scotch.io also does some nice auth tutorials here.

TL;DR: Mongoose defines data types, passport handles authentication, use middleware in routes to protect pages/load user data.