Weave Code
Php Openid Client Laravel Package
facile-it/php-openid-client
Full OpenID Connect client for PHP supporting OAuth 2.0 authorization code, implicit and hybrid flows, discovery, dynamic client registration, UserInfo/ID tokens with JWT signing and encryption, refresh tokens, and token revocation/introspection.
facile-it/php-openid-client is a full OpenID Connect client for PHP, largely based on the excellent node-openid-client. It supports core OAuth 2.0 and OpenID Connect flows, with JWT signing/encryption handled via the JWT Framework; the gmp PHP extension may be required.
- Authorization Code, Implicit, and Hybrid flows
- Discovery, Dynamic Client Registration, and registration management
- UserInfo endpoint, ID tokens, request objects, and refresh tokens
- Token revocation and token introspection (including JWT responses)
- Client authentication with
client_secret_jwtandprivate_key_jwt
Frequently asked questions about Php Openid Client
- Is facile-it/php-openid-client a Laravel package or a Socialite replacement?
- It is a framework-agnostic PHP OpenID Connect client, not a Laravel package, and it should not be treated as a drop-in Laravel Socialite replacement. In Laravel, use it behind a dedicated adapter or service provider and keep controllers thin. Socialite is usually simpler for basic Google or Microsoft login unless you need advanced OIDC flows.
- How do I install facile-it/php-openid-client in a Laravel application?
- Install the package with Composer, then add a PSR-18 HTTP client, PSR-7/17 factories, and a PSR-16 cache adapter because Laravel does not ship all of these by default. Guzzle plus a PSR-7 implementation is a likely path. The package supports PHP 8.1+ as of 0.4.0 and may require the gmp extension, so verify your runtime before adoption.
- What Laravel and PHP versions does this OIDC client support?
- The package is framework-agnostic and supports PHP 8.1+ as of version 0.4.0. It does not publish a Laravel-specific support matrix, so Laravel compatibility depends on your PHP version, Composer dependencies, and PSR adapter choices. Verify the actual release tag and dependency constraints before pinning it in a Laravel application.
- Which OIDC and OAuth flows does facile-it/php-openid-client support?
- It supports OAuth 2.0 and OpenID Connect authorization code, implicit, and hybrid flows, plus refresh token, offline access, and client credentials grants. It also covers UserInfo and ID tokens with JWT signing and encryption, discovery, dynamic client registration, token revocation and introspection, request objects, and client authentication methods such as client_secret_jwt and private_key_jwt. Confirm the specific features your IdP requires before relying on them.
- How should I integrate php-openid-client with Laravel's service container?
- Bind IssuerBuilder, ClientBuilder, AuthorizationService, UserInfoService, and optional registration, introspection, or revocation services in a Laravel service provider. Put issuers, clients, scopes, redirect URIs, cache TTLs, and algorithm policy in configuration such as config/openid.php. Use a dedicated OpenIdConnectService or adapter for redirect URI generation, callback validation, claim mapping, and token handling, and resolve issuer metadata lazily or through cache rather than during application boot.
- Can I use Laravel's cache and session with this package?
- The package expects PSR-16 caching, while Laravel's cache is not PSR-16 by default, so you will likely need an adapter over Laravel cache or Redis. For sessions, its SessionCookieMiddleware depends on dflydev/fig-cookies, so in Laravel it is often safer to implement AuthSessionInterface using Laravel's own session and cookie handling. Design state and nonce storage carefully as part of your adapter.
- Does facile-it/php-openid-client support PKCE and RP-initiated logout?
- The package has broad OIDC specification coverage, but the technical assessment explicitly says to verify PKCE, RP-initiated logout, clock skew, JWKS rotation, encrypted ID tokens, mTLS certificate rotation, and algorithm support. Do not assume these edge cases work for your IdP without integration tests. Treat them as explicit acceptance criteria before production.
- What are the production risks of using this package in Laravel?
- This is security-sensitive code with low adoption signals, including 47 stars, zero dependents, and no indicated commercial support. Dependency risk includes JWT Framework, PSR implementations, gmp, and cache or session adapters, and documentation is mostly README, changelog, and releases with no Laravel integration guide. Pin versions, require a security review, verify release provenance and cadence, and assign ownership for CVE monitoring.
- When should I choose facile-it/php-openid-client instead of Laravel Socialite?
- Choose it when requirements include enterprise OIDC SSO, multiple identity providers, dynamic client registration, token introspection or revocation, request objects, JARM or JAR, mTLS, or client assertion flows. For simple Login with Google or Microsoft, Laravel Socialite or a provider SDK is usually the better fit unless advanced OIDC flows are explicitly required. Treat this package as a specialized protocol engine behind a Laravel-owned adapter.
- How do I test and harden a Laravel OIDC integration before production?
- A basic authorization-code flow proof of concept is realistic, but production hardening requires security testing, cache design, and a clear identity-linking policy. Validate state and nonce handling, authorization code exchange, ID token signatures, issuer and audience checks, PKCE, JWKS rotation, clock skew, encrypted tokens, and algorithm policy against your real IdP. Keep application users separate from OIDC subjects, persist external identities explicitly, and pin versions before release.
Weaver
How can I help you explore Laravel packages today?