Weave Code
Php Openid Client Laravel Package
facile-it/php-openid-client
Full-featured PHP OpenID Connect/OAuth2 client with discovery and dynamic client registration. Supports authorization flows, refresh/client credentials grants, userinfo & ID tokens, JWT signing/encryption, request objects, token revocation/introspection, and advanced client auth.
PHP OpenID Client
Frequently asked questions about Php Openid Client
- How do I integrate php-openid-client with Laravel for Google OAuth login?
- Use Laravel’s HTTP client (Guzzle) as the PSR-7 implementation, configure the client via the service container, and leverage the AuthorizationService for the Authorization Code Flow with PKCE. Store tokens in Laravel’s encrypted database or cache, and handle callbacks with the provided middleware. The package’s SessionCookieMiddleware ensures secure state management.
- Does this package support Laravel 10+ and PHP 8.1+ only, or can it work with older Laravel versions?
- The package officially requires PHP 8.1+, which aligns with Laravel 10+. For Laravel 8.x or 9.x, you may need to manually adjust dependencies (e.g., JWT Framework or PSR-7 implementations) or use a compatible fork. Always test thoroughly in your CI/CD pipeline before deployment.
- How do I handle token refresh in Laravel using this package?
- Use the RefreshTokenGrant to exchange expired access tokens for new ones. Store refresh tokens securely in Laravel’s database (encrypted) or cache (short-lived). Implement a Laravel event listener or job to auto-refresh tokens before expiration, leveraging Laravel’s queue system for reliability.
- Can I use this package for dynamic client registration with multi-tenant SaaS providers?
- Yes, the package fully supports OIDC Dynamic Client Registration (RFC 7591). Configure the Issuer with dynamic registration enabled, then use the ClientRegistrationService to provision clients at runtime. Store registration metadata in Laravel’s database or cache, and associate clients with tenants via Laravel’s Eloquent relationships.
- What’s the best way to test OIDC flows in Laravel CI/CD without hitting real providers?
- Use mock OIDC providers like [mock-oidc](https://github.com/overleaf/mock-oidc) or [oidc-client-mock](https://github.com/panva/oidc-client-mock) in your tests. Configure the package’s Issuer to point to the mock endpoint, and verify token responses, userinfo claims, and error handling. Laravel’s HTTP tests can simulate redirects and callbacks seamlessly.
- How do I configure JWT signing/encryption for client authentication (e.g., client_secret_jwt) in Laravel?
- Use the JWT Framework to generate a JWT for client authentication. Configure the client’s `clientAuthentication` method with the JWT payload and private key. Store the private key securely in Laravel’s `.env` or a secrets manager. The package handles the signing process automatically during token requests.
- Is there a recommended way to handle token revocation or introspection in Laravel?
- Use the TokenRevocationService or TokenIntrospectionService to interact with provider endpoints (e.g., `/revoke`, `/introspect`). Cache introspection results in Laravel’s cache (PSR-16) to reduce API calls. For GDPR compliance, log revocation events in Laravel’s database and trigger cleanup jobs for affected user sessions.
- Can I combine this package with Laravel Sanctum or Fortify for hybrid authentication?
- Yes, use the package for OIDC authentication (e.g., Google login) and Laravel Sanctum/Fortify for session management. After OIDC login, create a Laravel session via Sanctum’s `createToken` or Fortify’s session handling. This hybrid approach ensures OIDC’s security while leveraging Laravel’s built-in auth features.
- How do I cache issuer metadata or JWKS to improve performance in production?
- Configure the Issuer’s cache layer using Laravel’s cache drivers (Redis, database) via PSR-16. Set a TTL (e.g., 24 hours) for metadata and JWKS to balance freshness and performance. Use Laravel’s cache tags to invalidate entries when provider configurations change, and monitor cache hit ratios in production.
- What are the alternatives to php-openid-client for Laravel, and when should I choose them?
- Alternatives include `league/oauth2-client` (simpler but less OIDC-focused) and `auth0/php-oidc` (Auth0-specific). Choose `php-openid-client` for full OIDC compliance, dynamic registration, and JWT support. Use `league/oauth2-client` if you only need basic OAuth2, or `auth0/php-oidc` if your stack is Auth0-exclusive. Benchmark performance for your use case.
Weaver
How can I help you explore Laravel packages today?