Singpass Login Laravel Package

Product Decisions This Supports

• Regulatory Compliance & Government Integration: Enables seamless integration with Singapore government identity services (SingPass, MyInfo, CorpPass) for B2G (Business-to-Government) or B2C (Business-to-Consumer) applications requiring official authentication or data retrieval.
• Roadmap for Digital Identity Expansion: Accelerates development of features requiring verified user identity (e.g., e-services, tax filings, or corporate compliance tools) by leveraging pre-built FAPI 2.0/OIDC infrastructure.
• Build vs. Buy Decision: Avoids reinventing OAuth2/OIDC + DPoP/PKCE/PAR (Pushed Authorization Requests) logic, reducing development time and security risks. Ideal for teams lacking FAPI expertise.
• Use Cases:
  • SingPass Login: Secure user authentication for government portals, fintech, or healthcare apps.
  • MyInfo Integration: Fetch citizen data (e.g., NRIC, DOB, nationality) for KYC or profile management.
  • CorpPass Login: Multi-factor authentication for corporate users accessing enterprise systems (e.g., IRAS, ACRA portals).
  • Hybrid Flows: Combine SingPass/MyInfo/CorpPass in a single app (e.g., a tax filing platform where individuals and businesses log in separately).

When to Consider This Package

• Adopt if:

  • Your product operates in Singapore and requires SingPass/MyInfo/CorpPass integration.
  • You need FAPI 2.0 compliance (DPoP, PKCE, PAR) without building from scratch.
  • Your team lacks OIDC/OAuth2 expertise but needs secure authentication.
  • You’re building a B2G or B2C app where government-issued identity is a core feature.
  • You prioritize maintainability over customization (package abstracts provider-specific quirks).

• Look Elsewhere if:

  • You need non-Singapore government identity providers (e.g., Estonia, India).
  • Your app requires deep customization of the OAuth2 flow (e.g., non-standard token handling).
  • You’re using a non-Laravel PHP framework (Symfony, Slim, etc.).
  • You need multi-provider support beyond SingPass/MyInfo/CorpPass (e.g., Google, Facebook).
  • Your project has strict real-time requirements (package introduces slight latency via PAR/DPoP).
  • You’re targeting mobile apps (package is web-focused; mobile SDKs may be needed for native flows).

How to Pitch It (Stakeholders)

For Executives:

*"This Laravel package lets us integrate with Singapore’s government identity services (SingPass, MyInfo, CorpPass) in weeks instead of months. It handles the complex OAuth2/OIDC security protocols (like DPoP and PKCE) for us, reducing development risk and cost. For example:

• SingPass Login: Securely authenticate users for our [Product X] without building a custom auth system.
• MyInfo Integration: Automatically fetch verified citizen data (NRIC, DOB) to pre-fill forms, improving UX and compliance.
• CorpPass: Enable corporate users to access our platform with government-issued credentials, reducing fraud. This aligns with our [digital identity roadmap] and [regulatory compliance goals], while cutting dev time by 70% compared to a custom solution."*

ROI:

• Speed: Ship features faster (e.g., MyInfo KYC in 2 weeks vs. 2 months).
• Security: Leverage battle-tested FAPI 2.0/OIDC with DPoP (prevents token tampering).
• Compliance: Meet Singapore government integration requirements out-of-the-box.
• Scalability: Supports all three major Singapore identity providers under one package.

For Engineering:

*"This package abstracts the FAPI 2.0/OIDC complexity (DPoP, PKCE, PAR, JWKS) into reusable Laravel services. Here’s how we’d use it:

1. Shared Infrastructure:

   • Configure ndi.php once for JWKS, signing keys, and DPoP (shared across SingPass/MyInfo/CorpPass).
   • No need to rewrite OAuth2 logic—it’s handled by FapiAuthenticationService and FapiCallbackService.

2. Provider-Specific Flows:

   • SingPass: Use /ndi/sp/login to trigger auth, then listen for SingPassSuccessfulLoginEvent to map users via NRIC.
   • MyInfo: Fetch scopes like mobileno or dob via /ndi/mi/callback; data arrives in MyInfoDataRetrievedEvent.
   • CorpPass: Handle hierarchical identity (entity + actor) with CorpPassSuccessfulLoginEvent and CorpPassDataRetrievedEvent.

3. Customization:

   • Override default routes/controllers in config (e.g., swap SingPassLoginController for your own).
   • Extend events (e.g., add logic to MyInfoDataRetrievedListener for data validation).

4. Security:

   • DPoP proofs are auto-generated for PAR, token, and UserInfo calls.
   • PKCE mitigates authorization code interception.
   • JWKS endpoint (/ndi/jwks) is always available for provider validation.

Trade-offs:

• Lock-in: Uses Laravel’s event system; tight coupling to PHP.
• Latency: PAR adds ~100ms vs. traditional OAuth2 (negligible for most use cases).
• Scope Validation: Package enforces MyInfo/CorpPass scope rules at runtime.

Next Steps:

1. Add accredifysg/singpass-login to composer.json.
2. Publish configs (php artisan vendor:publish) and set SINGPASS_CLIENT_ID, MYINFO_CLIENT_ID, etc.
3. Implement a listener for SingPassSuccessfulLoginEvent to map users.
4. Test with SingPass’s staging environment.

Alternatives Considered:

• Custom OAuth2 Library: Too much reinvention (FAPI 2.0 is niche).
• Auth0/Okta: Overkill for government-specific flows; higher cost.
• SingPass SDK: JavaScript-only; we need backend integration.

Recommendation: Proceed with this package for MVP, then evaluate if we need to fork for custom features."*