Weave Code
This project contains the Symfony OIDC bundle, which is directly based on https://github.com/jumbojett/OpenID-Connect-PHP
Frequently asked questions about Symfony Oidc Bundle
- Can I use drenso/symfony-oidc-bundle directly in Laravel, or is it strictly for Symfony?
- This bundle is designed for Symfony applications (5.4+) and cannot be used directly in Laravel. Laravel developers should explore alternatives like *league/oauth2-server* or *spomky-labs/oidc-client* for OIDC support. The bundle leverages Symfony’s Authentication Manager, which isn’t natively available in Laravel.
- What Laravel alternatives exist for OIDC authentication?
- For Laravel, consider *spomky-labs/oidc-client* (standalone OIDC library), *laravel/socialite* (with OIDC providers like *socialiteproviders/keycloak*), or *gloudemans/socialite-auth0* for Auth0-specific integrations. These avoid Symfony dependencies while offering similar functionality.
- How do I configure this bundle for Microsoft Entra ID (Azure AD) in Symfony?
- Microsoft Entra ID requires custom JWKS handling. Follow the [official documentation](https://github.com/Drenso/symfony-oidc/blob/main/docs/ms-entra-id.md) to enable `allow_discovery_access_token_issuer` and adjust the `jwks_uri` in your `drenso_oidc.yaml`. Ensure your Entra ID app registration includes the correct redirect URIs and token endpoints.
- Will this bundle work with Symfony 6.x or 7.x?
- Yes, this bundle supports Symfony 6.x and 7.x as it relies on the Authentication Manager, which is stable across these versions. No additional configuration is needed beyond Symfony’s standard setup. Always check the [latest release notes](https://github.com/Drenso/symfony-oidc/releases) for version-specific updates.
- How do I handle user authentication if my users are stored in a database with custom fields?
- Implement the `OidcUserProviderInterface` to map OIDC claims (e.g., `sub`, `email`) to your database schema. Override the `loadUserByOidcId()` method in your custom provider to fetch or create users. The bundle’s `user_identifier_property` setting lets you specify which claim (e.g., `sub` or `email`) to use for identification.
- What’s the recommended token validation leeway for production environments?
- The default `token_leeway_seconds: 300` (5 minutes) may cause issues in environments with strict clock synchronization (e.g., Kubernetes). Reduce this value to `60` (1 minute) or lower if your infrastructure guarantees accurate time synchronization. Avoid setting it too high to prevent replay attacks.
- Can I integrate multiple OIDC providers (e.g., Auth0 for employees, Keycloak for partners) in one Symfony app?
- Yes, the bundle supports multiple OIDC clients via the `drenso_oidc.yaml` configuration. Define separate clients under `clients:` and use Symfony’s firewall or router to direct users to the appropriate provider based on context (e.g., domain or path). Each client can have its own user provider.
- How do I enable the 'remember me' functionality with this bundle?
- Enable the `remember_me` option in your firewall configuration under `drenso_oidc:` in `security.yaml`. This generates a `REMEMBERME` cookie with a long-lived token. Note that this relies on Symfony’s built-in remember-me handler, which requires a secure cookie setup (e.g., `http_only`, `same_site` attributes).
- What should I do if my OIDC provider returns malformed user info responses?
- Extend the `OidcUserProvider` to validate or transform the user info response before mapping it to your user entity. Override the `extractUserInfo()` method to handle custom claims or error cases. Log malformed responses for debugging and consider adding fallback logic if the provider is unreliable.
- How do I test OIDC authentication in a CI/CD pipeline or staging environment?
- Use mock OIDC providers like *mockoon* or *oidc-proxy* to simulate Auth0, Keycloak, or Entra ID responses. Configure your bundle to point to the mock provider’s endpoints during testing. For integration tests, use Symfony’s `TestClient` with a custom `OidcUserProvider` that returns predefined user data without hitting a real IdP.
Weaver
How can I help you explore Laravel packages today?