- What is jacopo/authentication-sentry?
- jacopo/authentication-sentry is a fork of Cartalyst Sentry 2, a framework-agnostic authentication and ACL system. It provides a Sentry-backed user provider and auth guard so Laravel's native authentication can use Sentry users, credentials, and permissions. The package also bundles user management, groups, permission inheritance, login throttling, and persistence.
- Which Laravel and PHP versions does jacopo/authentication-sentry support?
- It targets Laravel 4-era conventions and PHP 5.3+, with composer constraints pinning illuminate/support and Symfony 2.x components circa 2012 to 2014. Those dependencies are not installable on PHP 7.4 or 8.x without ignoring platform requirements and patching. It does not support modern Laravel versions such as Laravel 5.x and later.
- How do I install jacopo/authentication-sentry?
- Installation is via Composer, followed by registering the package service provider and Sentry alias, then running its migrations. However, the dependency constraints only resolve on a frozen legacy PHP 5.3 to 5.6 and Laravel 4 stack. On any modern stack Composer will fail or require platform-req overrides and patches.
- Does jacopo/authentication-sentry work with Laravel 10 or PHP 8?
- No. The Composer constraints pin old Illuminate and Symfony components that cannot be resolved on PHP 8 or Laravel 10. Forcing installation with --ignore-platform-reqs plus patching is possible in theory but not viable for a real application. Adopting it on a modern stack creates immediate migration debt.
- Is jacopo/authentication-sentry maintained and secure?
- No. Upstream Cartalyst Sentry 2 has been deprecated for roughly a decade and has no security advisories, CVE process, or release cadence. This fork has unclear provenance, two stars, and zero dependents, so there is no ecosystem pressure or crowd-sourced triage. Any vulnerability disclosed after the fork point is permanently unpatched unless you patch it yourself.
- Can I use Sentry permissions with Laravel gates and policies?
- No. Sentry does not implement Illuminate\Contracts\Auth\Guard or Authenticatable, so it will not compose cleanly with middleware, gates, policies, or Auth::user() in Laravel 5.x and later. Its ACL model of users to groups to permissions with inheritance is sound, but the delivery mechanism sits alongside rather than inside Laravel's auth system.
- What database schema does Sentry require?
- Sentry expects to own its own schema: users, groups, users_groups, permissions, users_permissions, groups_permissions, persistences, and throttle tables. It uses its own persistence layer over the Illuminate\Database query builder rather than Eloquent models. Adopting it means designing your user model around its assumptions.
- How do I migrate from Sentry to Laravel native auth?
- Credential migration is the easy part because Sentry hashes with bcrypt by default, which is compatible with Hash::make. The hard part is porting users, groups, and permission semantics to Laravel's native guards, gates, and policies, or to a package like spatie/laravel-permission. Plan the exit horizon early, especially if the app must reach PHP 8 and Laravel 10+.
- What are alternatives to jacopo/authentication-sentry for Laravel?
- For modern applications use Laravel's native authentication with guards, gates, and policies, plus spatie/laravel-permission for ACL. Cartalyst Sentinel is the official successor to Sentry but is also legacy. For greenfield projects native auth is the recommended path; Sentry is only plausible for a frozen legacy estate.
- Why is jacopo/authentication-sentry high risk for production authentication?
- Authentication and authorization code has the highest blast radius in an application, and this package is unmaintained upstream with an unaudited fork diff. Any changes to session or remember-token handling in the fork must be reviewed for session-fixation risk. With no security patching and no dependents, your team owns every vulnerability in the stack.