- Can I use axium/identity directly in a Laravel project without Symfony?
- No, this is a Symfony Bundle, so direct Laravel integration isn’t supported. You’ll need to either rewrite the OAuth2/Keycloak logic as Laravel services or use Symfony’s HTTP Client to call Keycloak APIs directly. A hybrid approach (e.g., Dockerized Symfony microservice) is another option.
- How do I handle token validation in Laravel if I’m using this bundle?
- Since the bundle relies on Symfony’s EventDispatcher, you’ll need to create a Laravel middleware that validates tokens by calling Keycloak’s introspection endpoint. Cache tokens in Redis to reduce API calls and improve performance. Avoid mixing this with Laravel’s built-in auth middleware unless you abstract the logic.
- Will axium/identity conflict with Laravel Passport or Sanctum?
- Yes, it could. If your Laravel app already uses Passport or Sanctum for OAuth2, integrating this bundle may introduce duplicate auth flows or session conflicts. Audit your current setup first—consider deprecating one system entirely or using this bundle only for Keycloak-specific SSO features.
- What Laravel versions does axium/identity support?
- The bundle itself doesn’t natively support Laravel, but you can adapt it for Laravel 8.x–10.x by rewriting Symfony-specific components (e.g., Dependency Injection, middleware) into Laravel equivalents. Test thoroughly, as Symfony’s service container differs significantly from Laravel’s.
- How do I configure Keycloak credentials securely in Laravel?
- Store Keycloak URLs, client IDs, and secrets in Laravel’s `.env` file using environment variables. Avoid hardcoding credentials. Implement health checks to verify Keycloak connectivity during deployment. Use Laravel’s `config/services.php` to centralize Keycloak settings if integrating via API calls.
- Can I use axium/identity for role-based access control (RBAC) in Laravel?
- Yes, but you’ll need to map Keycloak roles to Laravel’s gate system or a custom RBAC package. The bundle provides OAuth2 flows, but Laravel’s authorization logic (e.g., `Gate::define()`) must be manually synced with Keycloak’s role assignments. Consider caching role mappings in Redis for performance.
- What’s the best way to handle token refreshes in production?
- Use Keycloak’s built-in token refresh flows via the bundle’s OAuth2 client or implement a Laravel job queue (e.g., Laravel Queues) to refresh tokens silently in the background. Store refresh tokens securely in the database or encrypted cache, not in session storage.
- Are there alternatives to axium/identity for Laravel + Keycloak?
- Yes. For Laravel, consider `gluu/keycloak-laravel` or `spatie/laravel-keycloak` for tighter integration. If you prefer a microservices approach, deploy Keycloak separately and use Laravel’s HTTP client to interact with its APIs. Symfony bundles like this are best for monolithic Symfony apps.
- How do I test axium/identity in a Laravel CI pipeline?
- Mock Keycloak’s OAuth2 endpoints using tools like VCR or Pest’s HTTP testing. Test token validation, role mapping, and error handling (e.g., expired tokens, network failures). Ensure your Laravel middleware and services behave identically in staging and production environments.
- What’s the performance impact of using this bundle in Laravel?
- The bundle itself won’t add overhead if you call Keycloak APIs directly, but Symfony’s DI and event systems may introduce latency if fully integrated. Benchmark token validation times and cache responses in Redis. Avoid synchronous calls to Keycloak for critical paths.