Symfony Oidc Bundle Laravel Package

Product Decisions This Supports

• Single Sign-On (SSO) Implementation: Accelerates adoption of OIDC-based SSO for enterprise or multi-tenant applications, reducing friction for users and admins.
• Compliance & Security: Enables integration with regulated identity providers (e.g., Microsoft Entra ID, Keycloak) to meet GDPR, HIPAA, or industry-specific compliance needs.
• Build vs. Buy: Avoids reinventing OIDC authentication from scratch, leveraging a battle-tested Symfony bundle with support for major IdPs (Auth0, SURFconext, etc.).
• Roadmap Prioritization:
  • Phase 1: Integrate OIDC for B2B/B2C portals to unify authentication across services.
  • Phase 2: Extend to internal tools (e.g., admin dashboards) for seamless SSO.
  • Phase 3: Explore multi-tenant support with dynamic client configurations.
• Use Cases:
  • Enterprise SaaS: Unified login for customers/employees across apps.
  • Government/Education: Integration with SURFconext or OpenConext for institutional access.
  • Legacy Modernization: Migrate older auth systems to OIDC without full rewrite.

When to Consider This Package

• Adopt When:

  • Your stack is Symfony 5.4+ (or 6+) with PHP 8 (required for auth manager compatibility).
  • You need OIDC support for Auth0, Keycloak, Microsoft Entra ID, or SURFconext (pre-validated IdPs).
  • Your team prefers Symfony’s ecosystem over standalone PHP libraries (e.g., jumbojett/OpenID-Connect-PHP).
  • You require remember-me, logout, or user info endpoints with minimal custom code.
  • Your user provider can be extended to handle OIDC data (e.g., OidcUserProviderInterface).

• Look Elsewhere If:

  • You’re not using Symfony (consider league/oauth2-server or hybridauth/hybridauth).
  • You need OIDC for non-Symfony PHP apps (use the underlying jumbojett/OpenID-Connect-PHP directly).
  • Your IdP is unsupported (e.g., custom SAML/OIDC providers; check for community PRs or alternatives like knpuniversity/oauth2-client-bundle).
  • You require legacy Symfony <5.4 or PHP <8 (use v1.x branch or another bundle).
  • Your use case demands advanced customization (e.g., non-standard token validation) beyond the bundle’s config.

How to Pitch It (Stakeholders)

For Executives:

"This bundle lets us standardize authentication across our Symfony apps using OpenID Connect (OIDC), cutting user login friction by 50%+ while supporting enterprise IdPs like Microsoft Entra ID and Keycloak. It’s a drop-in solution that replaces legacy auth systems, reduces support costs (no custom token handling), and aligns with compliance needs. For example, [Customer X] cut their onboarding time by 3 weeks by integrating SURFconext for their Dutch education clients. The bundle’s Symfony-native design means our dev team can implement it in 2–3 sprints with minimal risk."

Key Outcomes: ✅ Unified login across apps (B2B/B2C). ✅ Regulatory compliance (GDPR, HIPAA) via supported IdPs. ✅ Lower TCO than building custom OIDC or maintaining multiple auth systems.

For Engineering:

*"This is a Symfony-first OIDC bundle built on jumbojett/OpenID-Connect-PHP, offering:

• Zero reinvention: Handles PKCE, token validation, and user info flows out of the box.
• IdP compatibility: Works with Auth0, Keycloak, Microsoft Entra ID (with minor config), and SURFconext (tested).
• Symfony 6+ ready: Uses the new authentication manager and PHP 8 for performance.
• Extensible: Customize user providers, token leeway, or logout behavior via YAML/config.
• Dev-friendly: Symfony Flex auto-generates .env vars and config files; clear docs for edge cases (e.g., ADFS, Entra ID).

Trade-offs:

• Lock-in: Tied to Symfony’s auth system (but future-proof for 6.x).
• PHP 8 required: No support for legacy stacks (use v1.x if needed).
• Logout caveats: SSO logout is opt-in due to provider limitations (see enable_end_session_listener).

Recommendation: Start with the default config for Auth0/Keycloak, then extend for custom IdPs. The OidcUserProviderInterface lets you map OIDC claims to your user model cleanly."*

Action Items:

1. Spike: Test with your primary IdP (e.g., Auth0) in a staging environment.
2. Architecture: Plan user provider extensions (e.g., ensureUserExists() for new accounts).
3. Security: Audit token leeway (token_leeway_seconds) and cache times (jwks_cache_time) for production.