- How do I install alexandergabriel/filament-oauth2 in a Laravel Filament app?
- Install it with Composer, pinning to the exact version 2.0.1 for your first integration: composer require alexandergabriel/filament-oauth2:2.0.1. Laravel package auto-discovery should register the service provider, but confirm this in the package's composer.json since the provided README excerpt is empty. Then publish any config the package ships, add your OAuth2/OIDC provider credentials, and verify the login option appears on your Filament panel's login page. Before rolling out, check boot-time cost and that the provider respects config:cache.
- Which Laravel and Filament versions does filament-oauth2 support?
- The package's 2.0.1 release notes are empty, so there is no published compatibility matrix to rely on. Check the composer.json constraints for laravel/framework, php, and filament/filament before committing to anything. A 2.x release may have dropped older Laravel majors, so confirm it supports your current major and the next one you plan to adopt. Pin to 2.0.1 first, run your test suite, then loosen to ^2.0 once you have a passing baseline.
- Does it work with identity providers like Entra ID, Okta, Keycloak, or Google?
- The package is described as supporting OAuth2 and OpenID Connect, so any standards-compliant provider should work if you can supply the client credentials and endpoint settings it exposes in config. That includes Entra ID, Okta, Keycloak, Auth0, and Google, but the exact configuration keys depend on the package's config file, so verify discovery and endpoint options against your IdP. Always register a staging client and test the redirect and callback round trip before configuring production credentials.
- How does claim mapping to local users work, and what happens on first login?
- Claim mapping translates IdP claims such as sub, email, and name into local user attributes so an external identity can be linked to an existing or newly created Eloquent user. Review the mapping configuration to decide whether unknown users are auto-provisioned or rejected, and whether matching uses email or a provider-specific subject ID. Prefer an immutable subject identifier over email, because matching on email allows account takeover after an address change or reassignment.
- Can users still log in with standard email and password alongside SSO?
- The package blurb states external identity providers work alongside standard credentials, which means it plugs into Filament's existing authentication flow rather than replacing it. Confirm in staging that your panel's credentials form still renders and that the auth guard and session behavior are unchanged. Test both login paths in the same session to catch guard conflicts, and decide whether SSO users should be blocked from password login entirely.
- Does the package publish migrations or register middleware?
- The README excerpt provided is empty, so verify this yourself on a scratch branch by installing the package and diffing the vendor:publish output. Anything it adds to your schema becomes part of your database and is hard to reverse in production, so review every migration before deploying. Also check whether its service provider registers global middleware or overrides container bindings, since those raise review cost and can affect unrelated request paths.
- How do I test OAuth2 and OIDC login flows in CI without a real identity provider?
- Mock the token and userinfo endpoints rather than calling a real IdP, using Http::fake or an injected HTTP client that returns canned discovery documents, tokens, and claim payloads. Assert the user linking behavior, the redirect to the provider, and the callback handling, including failure cases like an invalid state parameter or an expired token. Keep one manual smoke test against a staging IdP so the full browser redirect and callback round trip is exercised at least once.
- Is filament-oauth2 safe to use in production?
- Treat it as a library-level dependency that should not require extra infrastructure, but pin 2.0.1 for the first release and wrap it behind a thin internal adapter so you can swap or pin versions without touching call sites. The main risks are version skew against your Laravel and Filament majors, schema changes from published migrations, and transitive dependency conflicts, which you can inspect with composer why. A package's own CI passing does not prove it works with your middleware, guard, or tenancy model, so run your full test suite plus a smoke test of the login paths before going live.
- How does filament-oauth2 compare to using Laravel Socialite with Filament?
- Laravel Socialite paired with a custom Filament login button is the common alternative and gives you full control over the redirect, callback, and user-provisioning logic, but you write all that glue yourself. This package trades that control for a Filament-native integration with provider configuration and claim mapping already built in. If you need several IdPs with minimal code, it is worth evaluating; if you need unusual flows or custom provisioning rules, Socialite may be simpler to reason about and maintain.
- Is the package actively maintained, and how should I handle the 2.x version?
- The 2.0.1 release shipped with empty release notes and there is no prior evaluation baseline, which is a weak maintenance signal, so check commit recency and issue-response cadence over the last 12 months directly in the repository. The jump to 2.x implies at least one breaking change boundary was crossed, and the patch increment suggests stabilization work rather than new features. Read the actual changelog and commit diff instead of the release notes field, pin the exact version, and isolate the package behind your own interface until you have confidence in its cadence.