Platform Sso Bundle Laravel Package

Technical Evaluation

Architecture Fit

• OroPlatform Dependency: The bundle is tightly coupled with OroPlatform (a Symfony-based CRM/ERP framework), which may not align with a vanilla Laravel architecture. Key concerns:

  • Laravel vs. Symfony: OroPlatform uses Symfony components (e.g., Dependency Injection, Event Dispatcher), while Laravel abstracts these. Direct integration may require compatibility layers (e.g., Symfony Bridge in Laravel).
  • Database Schema: OroPlatform’s SSO bundle assumes specific database structures (e.g., oro_sso_account, oro_sso_provider). Laravel’s Eloquent may need custom migrations or adapters.
  • Event System: Oro’s event-driven architecture (e.g., Oro\Bundle\SSOBundle\Event\ProviderEvent) may clash with Laravel’s event system unless bridged.

• Generic SSO Abstraction: The bundle’s goal of supporting multiple providers (Google, Facebook, LinkedIn, etc.) is valuable but untested (0 stars, no clear adopters). Risk of incomplete provider implementations or undocumented edge cases.

Integration Feasibility

• Symfony-to-Laravel Compatibility:

  • Pros: Leverages Symfony’s HttpFoundation (used in Laravel via symfony/http-foundation), OAuth2 libraries (e.g., league/oauth2-client), and event systems.
  • Cons: Oro’s service containers, twig templates, and workflow integrations are Laravel-foreign. Requires:
    • Symfony Bridge: Install symfony/bridge and symfony/dependency-injection to mimic Oro’s DI.
    • Custom Service Providers: Rewrite Oro’s OroSSOBundle services for Laravel’s container.
    • Route/Controller Overrides: Laravel’s routing (routes/web.php) differs from Symfony’s YAML/XML routes.

• Provider-Specific Risks:

  • Undocumented Configs: No examples for non-Google providers (e.g., LinkedIn’s r_liteprofile scope or Facebook’s fields parameter).
  • State Management: Oro’s SSO uses Session and FlashMessages; Laravel’s session() helper may need wrappers.

Technical Risk

Key Questions

1. Why OroPlatform?

   • Is the team already using OroPlatform, or is this a Laravel-first project?
   • If Laravel-only, what’s the ROI of adopting Oro’s SSO vs. native packages (e.g., socialiteproviders/socialite)?

2. Provider Coverage

   • Are all required providers (e.g., Microsoft, GitHub) fully implemented?
   • How are custom scopes/permissions handled per provider?

3. Authentication Flow

   • Does the bundle support PKCE (critical for SPAs/mobile)?
   • How are failed logins or revoked tokens managed?

4. Data Mapping

   • How are SSO user data (e.g., email, name) mapped to Laravel’s users table?
   • Are there custom fields or workflow triggers (e.g., "auto-create user on SSO login")?

5. Testing

   • Are there unit/integration tests for Laravel compatibility?
   • How is CSRF protection handled in OAuth callbacks?

Integration Approach

Stack Fit

• Laravel Compatibility Matrix:

  Component	Laravel Equivalent	Notes
  Symfony DI	Laravel’s Service Container	Use Illuminate\Container wrappers
  Oro Events	Laravel Events (event())	Bridge via Symfony\Contracts\EventDispatcher
  Twig Templates	Blade (@include)	Replace or use symfony/twig-bridge
  Doctrine ORM	Eloquent	Custom repositories or doctrine/dbal
  Symfony Security	Laravel Auth (auth())	Hybrid approach needed

• Recommended Tech Stack Additions:

  • OAuth Libraries: league/oauth2-client (already used by Oro).
  • Session Handling: symfony/http-foundation for session compatibility.
  • Testing: pestphp/pest + mockery/mockery for provider tests.

Migration Path

1. Phase 1: Dependency Isolation

   • Install the bundle in a Laravel-compatible mode:

     composer require digitalstate/platform-sso-bundle --ignore-platform-reqs
     

   • Override Oro’s OroSSOBundle services in config/services.php:

     'providers' => [
         \DigitalState\PlatformSSOBundle\Provider\GoogleProvider::class,
         // Add other providers...
     ],
     

2. Phase 2: Laravel Integration Layer

   • Create a custom service provider (app/Providers/SSOServiceProvider.php) to:
     • Register Laravel’s auth guard for SSO.
     • Bind Oro’s UserProvider to Laravel’s AuthManager.
     • Example:

       public function register()
       {
           $this->app->bind(\Symfony\Component\Security\Core\User\UserProviderInterface::class,
               \DigitalState\PlatformSSOBundle\User\Provider::class);
       }
       

3. Phase 3: Route/Controller Adaptation

   • Replace Symfony routes with Laravel routes:

     Route::get('/login/{provider}', [SSOController::class, 'login']);
     Route::get('/callback/{provider}', [SSOController::class, 'callback']);
     

   • Extend SSOController to use Laravel’s auth() helper.

4. Phase 4: Provider-Specific Configs

   • Move provider configs from oro_sso.yml to Laravel’s config/sso.php:

     'providers' => [
         'google' => [
             'client_id' => env('GOOGLE_CLIENT_ID'),
             'client_secret' => env('GOOGLE_SECRET'),
             'scopes' => ['email', 'profile'],
         ],
         'linkedin' => [
             'client_id' => env('LINKEDIN_ID'),
             'scopes' => ['r_liteprofile', 'r_emailaddress'],
         ],
     ],
     

Compatibility

• Critical Conflicts:

  • Doctrine vs. Eloquent: If using Eloquent, create a data mapper to translate Oro’s User entity to Laravel’s User model.
  • Flash Messages: Replace Oro’s FlashMessage with Laravel’s session()->flash().
  • Twig: Either:
    • Use Blade templates, or
    • Install symfony/twig-bridge and configure Twig as a fallback.

• Workarounds:

  • Event Listeners: Use Laravel’s listen() method to intercept Oro events:

    Event::listen(OroSSOEvents::POST_AUTHENTICATION, function ($event) {
        // Custom logic after SSO login
    });
    

Sequencing

1. Proof of Concept (1-2 weeks)

   • Test Google SSO in a fresh Laravel project.
   • Verify token exchange, user data mapping, and login flow.

2. Provider Expansion (2-3 weeks)

   • Implement LinkedIn/Facebook providers.
   • Handle provider-specific quirks (e.g., LinkedIn’s state parameter).

3. Laravel Native Integration (3-4 weeks)

   • Replace Oro-specific components (e.g., FlashMessages → Laravel’s session).
   • Optimize database schema for Eloquent.

4. Performance Testing (1 week)

   • Benchmark OAuth flows against socialiteproviders/socialite.
   • Profile memory/CPU usage during token validation.

Operational Impact

Maintenance

• Dependency Risks:

  • OroPlatform Abandonment: If Oro’s SSOBundle is deprecated, this package may become unsupported. Fork and maintain critical components.
  • Provider Updates: OAuth providers (e.g., Google’s API changes) may break integrations. Monitor provider deprecations (e.g., LinkedIn’s OAuth 2.0 changes).

• Customization Overhead:

  • Template Changes: Twig templates may need Blade replacements.
  • Business Logic: Oro’s workflows (e.g., "auto-assign roles") may require Laravel-specific adjustments.

Support

• Debugging Challenges:
  • Undocumented Behavior: No community