Nova Okta Laravel Package

Product Decisions This Supports

• Enterprise admin access via Okta SSO: This package is relevant when a Laravel Nova admin surface needs to use Okta as the identity provider, including login, logout, and the two-factor.login bridge. v3.0.0 keeps those flows intact while aligning default logout URLs with common Okta conventions.
• Build vs. buy for Nova authentication: Rather than maintaining custom Okta/Nova auth code, teams can adopt a package that already covers the Nova panel integration and maintains compatibility across Nova 5, Laravel 11/12/13, and PHP 8.3/8.4.
• Security and compliance roadmap: The release reinforces standardized sign-out handling, which matters for internal admin access, session termination, and identity-provider consistency. This is a maintenance/alignment release rather than a new feature release.
• Upgrade planning for v2 deployments: v3.0.0 changes the default sign-out redirect URI from {nova-path}/authorization-code/callback/logout to {nova-path}/authorization-code/logout. This is not a code-level route-name break, but it is an operational configuration change for teams on v2.0.0: update the Okta Sign-out redirect URI or pin OKTA_CALLBACK_LOGOUT_PATH.
• Low-risk adoption for v1/standard Okta setups: Teams already whitelisting authorization-code/logout, or upgrading from v1.x, should not need changes.
• Roadmap signal: This release does not add product capabilities; it reduces integration drift with Okta conventions and keeps the package’s CI/compatibility posture current.

When to Consider This Package

Consider adoption when:

• Your organization uses Okta as the identity provider and runs Laravel Nova 5 for internal/admin tooling.
• You need Okta-backed SSO, logout, and MFA/two-factor flows without building and maintaining custom Nova auth integration.
• You value a small integration surface: route names, the login override, and route('nova-okta.logout') remain unchanged in v3.0.0.
• You are on or planning toward Laravel 11/12/13 and PHP 8.3/8.4; the release reports green CI across that matrix.
• You can coordinate Okta admin configuration changes, especially if upgrading from v2.0.0.

Look elsewhere when:

• You are not using Laravel Nova or not using Okta as the IdP.
• You need a broader identity abstraction across multiple IdPs, complex multi-tenant authorization, or non-Nova application surfaces.
• Your organization cannot change Okta Sign-out redirect URI configuration and cannot use OKTA_CALLBACK_LOGOUT_PATH pinning.
• You require new product features from this release; v3.0.0 is primarily a convention-alignment and maintenance upgrade.

How to Pitch It (Stakeholders)

For executives: This is a low-surface-area upgrade to our Laravel Nova/Okta authentication integration. It keeps admin SSO aligned with standard Okta logout conventions and avoids custom auth maintenance. The main decision is operational: v2 users must update the Okta sign-out redirect URI, or pin the existing path, before upgrading.

For engineering: v3.0.0 adopts bbs-lab/laravel-okta v3.0 defaults. NovaOktaPanel inherits path(), so there is no source change; route names, login override, and the two-factor.login bridge are unchanged. The risk is concentrated in the logout redirect default: from v2.0.0, point Okta’s Sign-out redirect URI at {nova-path}/authorization-code/logout or set OKTA_CALLBACK_LOGOUT_PATH. From v1.x or standard Okta apps already whitelisting that path, no action is required. CI is green with Pest at 100% coverage/MSI, PHPStan level 8, and Pint across the supported matrix.

For security/platform stakeholders: The change standardizes logout behavior with Okta’s common convention, which supports cleaner session termination and identity-provider consistency. Approve the upgrade with a short Okta configuration check for v2 deployments.