Weave Code
Singpass Login Laravel Package
accredifysg/singpass-login
Laravel package for SingPass Login, MyInfo, and CorpPass using FAPI 2.0-style auth: OpenID discovery, Pushed Authorization Requests (PAR) with DPoP, PKCE, and private-key JWT client assertions. Includes shared services and thin provider controllers.
A Laravel Package for integrating Singpass Login, Myinfo, and Corppass
Frequently asked questions about Singpass Login
- What Laravel versions does this package support?
- This package requires **Laravel 9+** and **PHP 8.1+** due to named arguments and attributes. Ensure your project meets these requirements before installation. The package leverages Laravel’s native features like events and HTTP clients, so no additional frameworks are needed.
- How do I securely store the NDI_PRIVATE_JWKS for JWT assertions?
- The package does not enforce a storage method, but **AWS KMS, HashiCorp Vault, or encrypted .env files** are recommended. Avoid committing private keys to version control. Use Laravel’s `encryption` service or environment variables with restricted access to store the JWKS securely.
- Can I use this package for CorpPass integration without SingPass or MyInfo?
- Yes, the package is modular and supports **SingPass, MyInfo, and CorpPass independently**. Configure only the providers you need in `config/ndi.php` and `.env`. CorpPass requires additional scopes (e.g., `user.identity`, `actor`) and hierarchical entity-actor resolution, which the package handles via events and thin controllers.
- What happens if SingPass returns a malformed JWT token during MyInfo scope validation?
- The package validates JWT signatures and claims but relies on **Laravel’s exception handling** for malformed tokens. Configure a global exception handler to redirect users to an error page or log the failure. Silent failures are avoided by default, but you may customize error responses in `app/Exceptions/Handler.php`.
- How do I test the PAR (Pushed Authorization Request) flow locally?
- Mock SingPass’s PAR endpoint using Laravel’s HTTP testing or tools like **Pest or PHPUnit**. The package provides `FapiAuthenticationService` for manual PAR requests, and you can stub the `pushed_authorization_request_endpoint` in `config/ndi.php` during testing. Validate DPoP proofs by inspecting the `Authorization` header in test responses.
- Is Laravel’s default file session driver supported for state management in distributed environments?
- No, **file sessions are not recommended** for distributed setups. Use **Redis or Memcached** for session storage to ensure the `state` parameter (CSRF protection) persists across servers. Configure the session driver in `.env` (`SESSION_DRIVER=redis`) and ensure your Redis instance is secure.
- How do I handle CorpPass’s entity-actor model in my application?
- CorpPass returns both an **entity (company)** and an **actor (user)**. The package fires `CorpPassLoggedIn` events with both objects, allowing you to map them to your internal models (e.g., `Company` and `User`). Use event listeners to resolve relationships or store the data in your database.
- Are there rate limits I need to consider for SingPass/MyInfo/CorpPass APIs?
- Yes, **SingPass and MyInfo APIs enforce rate limits** (e.g., 100 requests/minute). Implement Laravel’s `throttle` middleware or use packages like `spatie/rate-limiter` to enforce limits. Monitor API responses for `429 Too Many Requests` and adjust your throttling rules accordingly.
- What’s the difference between `SingPassUser::getNric()` and `sub_attributes.identity_number`?
- `getNric()` is deprecated in favor of `sub_attributes.identity_number` to align with FAPI 2.0 standards. Update your code to use the new method, as it provides more consistent access to identity attributes across providers. The package includes a migration guide in the README for refactoring existing listeners.
- Can I extend this package to support additional OpenID providers (e.g., a custom FAPI 2.0 provider)?
- Yes, the package’s **modular design** allows adding new providers. Extend the `FapiAuthenticationService` and create a new `ProviderConfig` for your custom provider. Register routes and events in a service provider, following the existing pattern for SingPass/MyInfo/CorpPass. The shared FAPI 2.0 layer handles PAR, DPoP, and PKCE for you.
Weaver
How can I help you explore Laravel packages today?