Weave Code
Openid Connect Bundle Laravel Package
itk-dev/openid-connect-bundle
Symfony bundle for OpenID Connect authentication. Configure OIDC providers, handle login and logout, discover endpoints, validate tokens, and map claims to users for secure single sign-on in Symfony applications.
Symfony bundle for open-id connect
Frequently asked questions about Openid Connect Bundle
- Can I use itk-dev/openid-connect-bundle in a Laravel application?
- No, not directly. It is a Symfony bundle, so Composer will install the code but Laravel will never register its services, security factory, or configuration. Making it work in Laravel would require a custom adapter or extracting the protocol layer into a Laravel-native package. For most Laravel teams, a dedicated OIDC package or a Socialite driver is the faster path.
- What does itk-dev/openid-connect-bundle actually do?
- It integrates OpenID Connect authentication into Symfony applications. It discovers provider metadata, runs the authorization code flow with state and nonce validation, verifies token signatures and claims, and exposes the authenticated user to Symfony's security layer. Configuration is handled through standard bundle configuration, including multiple environments.
- Does it support PKCE and a secure authorization code flow?
- Yes. Version 6.1.0 added PKCE challenge generation, and the bundle already implements the authorization code flow with state and nonce validation. Token verification includes signature and claim checks. These are protocol-layer features, which makes them the most reusable part if you plan to port the logic elsewhere.
- Is version 6.1.0 a breaking change if I forked or depend on it?
- Semver says it is a minor release, but one change is behavioral: provider instances are no longer held across requests and are reconstructed per request. That can break callers who depended on hydration and changes the contract for anything forked from 6.0.0. Check for an UPGRADE note and read it before relying on the release notes alone.
- Is it compatible with Laravel Octane or other long-running workers?
- The bundle itself now documents a worker-mode contract and CI-gates it, and 6.1.0 stopped holding provider instances between requests. That removes a class of cross-request state bleed. However, this does not make it usable in Laravel Octane directly, because the Symfony bundle still does not register in Laravel. Any Symfony-to-Laravel adapter would need to implement the lifecycle contract correctly.
- What is a good Laravel alternative for OpenID Connect SSO?
- Most Laravel teams use Laravel Socialite with a community OIDC driver, or a dedicated Laravel OIDC package that registers a service provider and integrates with the auth guard. The itk-dev bundle is useful as a reference implementation, not as a dependency. Evaluate alternatives on token validation rigor, PKCE support, and maintenance activity.
- How do I install and configure it in a Symfony application?
- Install it with composer require itk-dev/openid-connect-bundle, enable the bundle in your kernel, and configure your OIDC provider through bundle configuration. You can use provider discovery from standard OpenID Connect metadata, set scopes, and wire the flow into your Symfony security firewall and user provider. Configuration supports multiple environments.
- Can I reuse its OIDC logic in a Laravel-native package?
- Yes, and that is its main value for Laravel teams. The protocol layer contains PKCE challenge and verifier handling, provider error callbacks, configurable scopes, and bounded config parsing. Those pieces are less tied to Symfony than the bundle wiring. Expect roughly four to six weeks to build a correct adapter or port, and budget extra time for lifecycle semantics.
- How can I test the OpenID Connect login flow locally?
- Version 6.1.0 added documentation for a mock identity provider, which gives you a local test loop without standing up a real IdP. You can run the flows against the stub and observe authorization, token, and error responses. This is especially useful for writing an acceptance spec before porting the logic to another framework.
- Is the project actively maintained and safe for production?
- It shows signs of active maintenance: seven pull requests in 6.1.0, CI checks, documented behavior, and a mock IdP. The risks are that it comes from a single originating organization in the Danish municipal sector, has no vendor or SLA, and contains security-critical validation logic without broad third-party scrutiny. Verify release behavior and review the source before depending on it in production.
Weaver
How can I help you explore Laravel packages today?