Weave Code
Fas Open Id Bundle Laravel Package
intracto/fas-open-id-bundle
Symfony bundle that integrates FAS OpenID Connect authentication, simplifying federated login, user identity handling, and secure access for applications using FAS as an identity provider.
Bundle that makes it easy to authenticate using Fas Open Id
Frequently asked questions about Fas Open Id Bundle
- Does intracto/fas-open-id-bundle work with Laravel?
- No. The package is a Symfony bundle, so it ships a Bundle class, a DI extension, YAML configuration under a bundle namespace, and a Symfony Security authenticator. Laravel has no equivalent bundle or extension lifecycle, and its service providers, container bindings, and guards are structurally different. Installing it in a Laravel app will not wire up any authentication and will only pull Symfony components into your dependency graph. Treat it as a protocol reference implementation rather than an installable Laravel module.
- How do I install and configure intracto/fas-open-id-bundle?
- In a Symfony application you would require the package with Composer, register the bundle in your bundle configuration, and define the FAS provider settings and scopes in YAML under the bundle namespace. You then hook the OpenID authenticator into your Symfony Security firewall and point it at a user provider that maps claims to your user class. There is no supported installation path that produces working FAS login inside Laravel.
- Which Symfony and PHP versions does this bundle support?
- The latest release is from October 2022, which predates Symfony 6's removal of the Guard component and Symfony 7's tighter DI and attribute conventions. Check the composer.json constraints before assuming compatibility with a current Symfony release, and expect work if the authenticator still targets Guard. PHP 8.x support is not documented in the overview and should be confirmed from the package metadata. Nothing in the project tracks Laravel's release cadence at all.
- What is FAS and why does it use private_key_jwt instead of a client secret?
- FAS is the Belgian Federal Authentication Service, an OpenID Connect provider for eID and itsme identities. It requires private_key_jwt client authentication, meaning each token request carries a signed client assertion JWT plus a registered public key, rather than a plain client secret exchange. That is the real value of this bundle: it is a working reference for the FAS endpoint paths, scope values, assertion signing, and eID claim mapping. Whether it implements key rotation or assumes a static key must be confirmed by reading the source.
- Can I use laravel/socialite or league/oauth2-client with FAS instead?
- Not without extension. Socialite and the stock league/oauth2-client providers perform client-secret exchanges and do not do private_key_jwt out of the box. The realistic Laravel approach is a small internal FasProvider on top of league/oauth2-client plus firebase/php-jwt to sign the client assertion, wrapped in a Socialite driver or a custom guard. Port the endpoint constants, scope names, and claim mapping from this bundle rather than depending on it.
- How does the bundle map OpenID claims to a user object?
- It converts incoming FAS claims into authenticated Symfony user objects through a user provider, which means the mapping is coupled to Symfony's UserProviderInterface. In Laravel you would port that logic into your own user resolution: match the eID identifier to a local account, persist the identity attributes and assurance level, and decide how to handle first-time logins. Whether eID versus itsme flows and different assurance levels are configurable should be verified in the code before relying on it.
- What ID token validation does this bundle actually perform?
- The overview describes callback handling with token and claim processing, but it does not document signature verification via JWKS fetch and cache, nor checks on iss, aud, exp, nonce, or acr. This is security-critical code on the authentication path, so audit the authenticator before trusting it. In any Laravel port, implement all of those validations explicitly, along with state and nonce handling and FAS end-session logout if you need single sign-out.
- Is intracto/fas-open-id-bundle still maintained?
- Signals are poor: one star, zero dependents, no issue triage, and a last release in October 2022. Unless Intracto confirms current ownership, treat the repository as dormant rather than merely quiet. An unmaintained component on the authentication path is materially riskier than elsewhere, because you inherit the CVE response burden yourself. Forking is viable since the code is MIT licensed, but you own it from that point.
- How do I test FAS login locally in a Laravel application?
- FAS requires application registration with the Belgian federal authority, acceptance-environment certification, and public key registration, none of which can be coded around. Most teams test against the acceptance environment with real credentials or stand up a stub OpenID Connect provider for local runs. In practice that procurement and onboarding timeline is the critical path, not the integration work, so start it early.
- What are the alternatives for OpenID Connect authentication in Laravel?
- You can build a custom Socialite driver or guard backed by league/oauth2-client and firebase/php-jwt, which gives you FAS-compatible assertion signing without Symfony dependencies. Generic OpenID Connect packages can work too, but any provider that assumes a client secret will need extending for private_key_jwt. Keep your signing keys in a secrets manager and port the FAS specifics from this bundle's source. If part of your estate is Symfony or API Platform, the bundle is a reasonable fit there as-is.
Weaver
How can I help you explore Laravel packages today?