Filament Okta Laravel Package

Product Decisions This Supports

• Build vs. buy for SSO logout: this plugin is a thin Filament adapter over bbs-lab/laravel-okta; it means the "buy" option is a config-level integration, not a custom OIDC implementation. If Okta is already the identity provider, this removes an SSO logout workstream from the roadmap entirely.
• Scope of the SSO investment: the plugin covers sign-out only (redirect URI plus logout initiator, per panel). Login/session issuance stays with the upstream laravel-okta package — so the decision here is "do we adopt the Filament logout wiring," not "do we adopt an auth stack."
• Multi-panel / multi-audience roadmap: configuration is keyed per panel (filament-okta.{panel}.logout, filament-okta.{panel}.callback.logout), so admin, partner, and customer panels can each have independent Okta app registrations without forking the plugin. This supports segmenting panels by audience without a bespoke auth service.
• Release-planning input for v3.0.0: this is a breaking change for anyone on v2.0.0 — default logout paths moved, and the Okta app's Sign-out redirect URI must be updated per panel or logout will fail. It is a no-op for v1.x or standard Okta apps already whitelisting authorization-code/logout. This needs a coordinated change ticket (app config in Okta + deploy), not a silent composer update.
• Operational risk framing: the upgrade touches a path that is only exercised when a user signs out. A misconfigured redirect URI can fail quietly (user stranded on an Okta error page after logout) rather than failing loudly in CI — so treat it as a QA-verifiable change, not a trust-the-pipeline change.
• Low maintenance-cost assumption is defensible: no src change in v3.0.0, route names are stable (route('filament-okta.{panel}.logout') still initiates logout), and CI is green at Pest 100% coverage / 100% MSI, PHPStan level 8, across Filament 5 × Laravel 11/12/13 × PHP 8.3/8.4. That combination supports treating the dependency as low-churn.

When to Consider This Package

Adopt when:

• Okta is the IdP and Filament panels are the primary authenticated surface — the package's whole value is per-panel logout wiring.
• You run multiple Filament panels, each with its own Okta application; per-panel path overrides are the reason to pick this over hand-rolling routes.
• You want sign-out behavior to be declarative config (OktaPlugin::make()->paths(...)) rather than middleware or controller code you own.
• You are on, or can move to, the supported matrix: Filament 5 with Laravel 11/12/13 and PHP 8.3/8.4.
• You can absorb a coordinated cutover: an Okta admin-console change (Sign-out redirect URI) shipped alongside the code deploy.

Look elsewhere when:

• You are on v2.0.0 and cannot change Okta app configuration on the same schedule as the deploy — the upgrade is only safe with both sides moved together, or with explicit callbackLogout: overrides pinned to the old paths.
• You need login, token refresh, group/role mapping, or SCIM provisioning. This package is logout-scoped; scope the rest against bbs-lab/laravel-okta or another solution before assuming this covers it.
• You are not on Okta, or you need a generic OIDC/SAML provider abstraction — the path conventions here are Okta-shaped by default.
• Okta app registrations are managed by a central IAM team with a slow change process; the v3.0.0 default change turns a Composer bump into a cross-team dependency.
• You are pre-Filament 5 or on PHP 8.2 or below — unsupported matrix.
• You need an SLA, vendor support contract, or security review artifacts. This is a community package; the assurance on offer is CI quality (100% coverage/MSI, PHPStan 8), not contractual.

How to Pitch It (Stakeholders)

For executives: We can retire a small but real piece of custom auth plumbing. SSO sign-out for our Filament admin surfaces becomes configuration rather than code we maintain, with per-panel settings so each audience's Okta app stays independent. The new v3.0.0 release aligns our defaults with Okta's own convention and requires one coordinated change: an Okta admin-console redirect-URI update per panel, shipped with the deploy. No code changes, no route changes. Cost is low and one-time; ongoing maintenance load drops.

For engineering: v3.0.0 of the plugin adopts bbs-lab/laravel-okta v3.0 and swaps the two default logout paths. callbackLogout: now sets the /logout landing (the Sign-out redirect URI), and logout: sets the /logout/redirect initiator. No src change; OktaPlugin::paths() keeps its named args; route names are unchanged, so route('filament-okta.{panel}.logout') still initiates logout. Upgrade path is binary: from v1.x or a standard Okta app already whitelisting authorization-code/logout, do nothing; from v2.0.0, either repoint each panel's Okta Sign-out redirect URI to {panel-path}/authorization-code/logout, or pin the old behavior explicitly via OktaPlugin::make()->paths(callbackLogout: '…') if the Okta change has to lag the deploy. Verification is manual by nature — exercise a real sign-out per panel in staging, because a bad redirect URI fails at logout time, not in CI. Supporting evidence for the bump: Pest 100% coverage and 100% MSI, PHPStan level 8, Pint clean, across the full Filament 5 × Laravel 11/12/13 × PHP 8.3/8.4 matrix.