Laravel OIDC

https://github.com/jeffersongoncalves/laravel-oidc
Admin
Laravel OIDC adds OpenID Connect support to Laravel via a custom Socialite driver, providing...
Tokens:2,954
Snippets:30
Trust Score:9.8
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install laravel-oidc with Composer

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Install the package via Composer.

```bash
composer require jeffersongoncalves/laravel-oidc
```

--------------------------------

### Multi-tenant OIDC redirect and callback with runtime config

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Multi-tenant setup with runtime configuration. Creates an OidcConfig from tenant data, sets it on the driver, and redirects. On callback, the same config is used to retrieve the user.

```php
use Laravel\Socialite\Facades\Socialite;
use JeffersonGoncalves\LaravelOidc\Data\OidcConfig;

$config = new OidcConfig(
    issuerUrl: $tenant->issuer_url,
    clientId: $tenant->client_id,
    clientSecret: $tenant->client_secret,
    redirectUri: route('sso.callback'),
    scopes: ['openid', 'email', 'profile'],
);

return Socialite::driver('oidc')
    ->setConfig($config)
    ->redirect();
```

```php
$oidcUser = Socialite::driver('oidc')
    ->setConfig($config)
    ->user();
```

--------------------------------

### Single-tenant OIDC redirect and callback with Socialite

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Single-tenant setup using configuration from .env. Defines routes for redirect and callback, retrieving the user via Socialite's OIDC driver. The user object exposes standard fields and OIDC-specific properties like idToken and idTokenClaims.

```php
use Laravel\Socialite\Facades\Socialite;

Route::get('/sso/redirect', fn () => Socialite::driver('oidc')->redirect());

Route::get('/sso/callback', function () {
    $user = Socialite::driver('oidc')->user();

    // $user->id            // sub claim
    // $user->email
    // $user->name
    // $user->token         // access_token
    // $user->idToken       // raw id_token JWT
    // $user->idTokenClaims // decoded + validated claims
});
```

--------------------------------

### Publish oidc-config

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Optionally publish the package configuration file.

```bash
php artisan vendor:publish --tag="oidc-config"
```

--------------------------------

### Run tests, analysis, and formatting before PR

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Commands to run before opening a pull request to ensure tests, PHPStan, and Pint pass.

```bash
composer test
```

```bash
composer analyse
```

```bash
composer format
```

--------------------------------

### Configure OIDC environment variables

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Set the default identity provider for single-tenant apps in the .env file.

```env
OIDC_ISSUER_URL=https://login.microsoftonline.com/{tenant-id}/v2.0
OIDC_CLIENT_ID=your-app-client-id
OIDC_CLIENT_SECRET=your-app-secret
OIDC_REDIRECT_URI=https://your-app.test/sso/callback
```

--------------------------------

### Run tests with composer test

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Runs the test suite for the package.

```bash
composer test
```

--------------------------------

### Configure JWT allowed algorithms

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Configure allowed JWT algorithms and a default algorithm for JWKS keys without an alg parameter. The default_algorithm must be in the allow-list; otherwise it is ignored.

```php
'jwt' => [
    'allowed_algorithms' => ['RS256', 'RS384', 'RS512', 'ES256', 'ES384'],
    'default_algorithm' => 'RS256',
],
```

--------------------------------

### Map non-standard claims (email to mail) in config and runtime

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Maps non-standard claim names to user fields. The first block shows configuration in config/oidc.php under the 'default' block. The second shows runtime configuration via OidcConfig. Unmapped fields keep standard OIDC claims.

```php
// config/oidc.php, "default" block
'user_field_mappings' => [
    'email' => 'mail',
],
```

```php
$config = new OidcConfig(
    issuerUrl: $tenant->issuer_url,
    clientId: $tenant->client_id,
    clientSecret: $tenant->client_secret,
    redirectUri: route('sso.callback'),
    userFieldMappings: ['email' => 'mail'],
);
```

--------------------------------

### HasOidcConfig trait for tenant models

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Uses the HasOidcConfig trait on a model to store IdP configuration. Expects columns issuer_url, client_id, client_secret (cast to encrypted), redirect_uri, and optional scopes JSON column. The toOidcConfig() method converts the model to an OidcConfig for use with Socialite.

```php
use JeffersonGoncalves\LaravelOidc\Concerns\HasOidcConfig;

class SsoConnection extends Model
{
    use HasOidcConfig;
}

Socialite::driver('oidc')
    ->setConfig($ssoConnection->toOidcConfig())
    ->redirect();
```

--------------------------------

### OIDC discovery without Socialite

Source: https://github.com/jeffersongoncalves/laravel-oidc/blob/master/README.md

Performs OIDC discovery without Socialite. The discover method returns an object with properties for authorization, token, userinfo, JWKS URI, and issuer.

```php
use JeffersonGoncalves\LaravelOidc\Facades\Oidc;

$discovery = Oidc::discover('https://login.microsoftonline.com/{tenant-id}/v2.0');

$discovery->authorizationEndpoint;
$discovery->tokenEndpoint;
$discovery->userinfoEndpoint;
$discovery->jwksUri;
$discovery->issuer;
```
Tokens:
Raw