Weave Code
Symfony Oidc Bundle Laravel Package
drenso/symfony-oidc-bundle
Symfony OIDC bundle adds OpenID Connect authentication to Symfony applications using the new authentication manager. Supports SURFconext/OpenConext, Keycloak, Auth0, Microsoft Entra ID and others. Requires Symfony 5.4+ and PHP 8.
OpenID connect bundle for Symfony
Frequently asked questions about Symfony Oidc Bundle
- Can I install drenso/symfony-oidc-bundle in a Laravel application?
- No, you should not install it in a Laravel app. It is a Symfony bundle that hard-requires Symfony's new authenticator manager, symfony/security-bundle, and Symfony 5.4 or later, which conflicts with Laravel's own pinned Symfony components. The viable path is to depend on jumbojett/OpenID-Connect-PHP directly or vendor the framework-agnostic OIDC core and build a Laravel guard, middleware, and service provider around it.
- Does this package support Laravel 10 or Laravel 11?
- It does not support Laravel directly. The package is built for Symfony 5.4+ and PHP 8, and its integration points are Symfony-specific: a DI extension, a security firewall listener, a LogoutEvent subscriber, and a Symfony Cache adapter. Laravel 10 and 11 run on PHP 8, so the PHP baseline aligns, but you must reimplement the Symfony glue as Laravel authentication code.
- What Symfony and PHP versions does drenso/symfony-oidc-bundle require?
- It requires PHP 8 and Symfony 5.4 or later because it depends on Symfony's new authentication manager, which became required in Symfony 6. The v1.x branch exists for older projects that cannot enable the new authenticator system or use PHP 8, but that branch is not the current line. For Laravel evaluation, only the PHP 8 requirement is relevant.
- How do I install and configure the Symfony OIDC bundle?
- In a Symfony app you install it with Composer, enable the bundle, configure a named client with discovery URL, client ID, client secret, and scopes, and wire it into security.yaml as a firewall authenticator. You then implement an OidcUserProviderInterface to map OIDC claims to your application's user object. The bundle handles discovery, JWKS retrieval, nonce verification, PKCE, token validation, and userinfo retrieval. None of that configuration translates to Laravel.
- Which identity providers work with this OIDC bundle?
- The README lists Auth0 by Okta, OpenConext/SURFconext, Keycloak, Microsoft Entra ID, and Microsoft ADFS as known to work. Only SURFconext is explicitly described as fully tested, and Microsoft Entra ID will not work with default configuration; it requires following a separate setup guide. On-prem ADFS v1 needs an opt-in flag. Any other IdP should be treated as untested until you run a conformance test against a real tenant.
- What is the best Laravel alternative for OpenID Connect authentication?
- There is no Laravel-native port of this bundle, so the practical alternatives are to use a maintained Laravel OIDC or socialite provider package, or to build a small internal adapter around jumbojett/OpenID-Connect-PHP. The Drenso bundle is valuable as a reference implementation for discovery, JWKS caching, nonce checks, PKCE, and token validation. Do not pull symfony/security-bundle into Laravel just to reuse its glue code.
- How can I reuse the OIDC protocol logic from this bundle in Laravel?
- Extract the framework-agnostic core: discovery and .well-known parsing, JWKS retrieval and caching, token validation with configurable leeway, nonce verification, PKCE S256 or plain, userinfo retrieval, and end-session support. Replace the Symfony DI extension, firewall listener, LogoutEvent subscriber, and PropertyAccessor-based identifier extraction with a Laravel guard or middleware, an OidcUserProvider implementing Illuminate\Contracts\Auth\UserProvider, a login redirect controller, and a callback route acting as check_path. Expect roughly 30 to 40 percent of the codebase to be directly portable and plan a three-to-five-day spike before committing.
- Is drenso/symfony-oidc-bundle safe for production authentication?
- It is a competently built and well-documented bundle, but authentication is security-sensitive and several defaults need review. Nonce verification can be disabled via disable_nonce, token_leeway_seconds defaults to 300, and logout is disabled by default because SSO logout cannot guarantee IdP-side logout. Misconfiguration here is an auth bypass rather than a cosmetic bug. If you fork or vendor it, assign an internal owner for security patching and define an SLA.
- How do I test OIDC login in a Laravel app without installing the Symfony bundle?
- Test the adapter at two levels: unit-test claim mapping, nonce validation, PKCE generation, and token leeway behavior with fixed JWKS and signed tokens, and integration-test the redirect and callback routes against a real or containerized IdP such as Keycloak. Include at least one conformance test per IdP you must support at launch, because IdP-specific quirks are real. Microsoft Entra ID and on-prem ADFS each need explicit configuration checks.
- Who maintains drenso/symfony-oidc-bundle and is it actively supported?
- It is a single-vendor project from Drenso, automatically mirrored from a private GitLab instance, with around 99 stars and zero dependents on Packagist. Issues and merge requests are accepted on GitHub, but the community is thin and you are largely on your own for integration problems. The upstream protocol engine is jumbojett/OpenID-Connect-PHP, so verify its maintenance cadence and CVE responsiveness directly rather than through the bundle. Licensing is Apache-2.0, which is permissive and compatible with commercial use and forking.
Weaver
How can I help you explore Laravel packages today?