Filament Sso Client Laravel Package

Product Decisions This Supports

• Enterprise tier gating. SSO is one of the most common contractual triggers for an "Enterprise" plan. This release gives you a shippable, Filament-native answer to "do you support Okta / Entra ID / Auth0 / Google Workspace?" without a bespoke auth roadmap item — useful input to pricing-tier and packaging decisions.
• Unblocking deals in security review. Federated logout plus Single Logout enforcement on panel requests is the detail that turns SSO from "a login button" into something that survives a security questionnaire. If enterprise buyers ask "can an admin session be revoked centrally when we deprovision someone?", this release is the enabling capability.
• Build vs. buy on identity. The package is a thin Filament integration over jeffersongoncalves/laravel-sso-client, not a from-scratch protocol implementation. That shifts the real decision from "build SAML/OIDC ourselves?" to "is a thin wrapper over this client acceptable?" — a materially cheaper question.
• Faster time-to-demo. Three auth modes (button, SSO-only, forced redirect) mean you can support mixed tenants — some with SSO mandated, some still on local credentials — from one codebase. That's a pilot-friendly configuration and shortens the enterprise POC cycle.
• Roadmap sequencing. Because this lands on Filament v3, it tells you what you cannot yet promise: Filament v4 support, SCIM provisioning/deprovisioning, per-tenant IdP configuration, or role/group mapping are all out of scope here and should be treated as separate roadmap items rather than assumed.

When to Consider This Package

Consider it when:

• Your admin/back-office surfaces are built on Filament v3 and you want SSO without rewriting the panel's auth stack.
• Your buyers are B2B/enterprise and expect IdP-initiated or SP-initiated login against a corporate identity provider.
• Compliance or security review requires centralized session termination — the federated logout and SLO enforcement are the specific features that satisfy this.
• You want mixed-mode tenants: SSO-only for some customers, optional SSO button for others.
• You are comfortable with the single dependency jeffersongoncalves/laravel-sso-client 1.1+ as the protocol layer, and want to keep your own surface area small.

Look elsewhere — or plan to build — when:

• You are on Filament v4 or planning to move soon; this is explicitly a v3 release.
• You need SCIM / automated provisioning and deprovisioning. SLO revokes sessions; it does not manage user lifecycle.
• You need group/role mapping from IdP claims, fine-grained authorization, or per-tenant IdP configuration that isn't covered by the client's config model.
• You need consumer/social login — this is a workforce-identity tool, not a social login kit.
• You require vendor SLAs, a support contract, or a security audit trail on the dependency. This is a 1.0.0 first release: no adoption history, no visible maintenance track record in the data at hand, and the maintenance risk sits partly with the upstream client.
• You already have a working Fortify/Socialite + custom OIDC flow and only need a login button — the added dependency may not pay for itself.

Treat this as an adoption bet on a young package, not a settled platform choice. Pin the version, wrap the integration behind your own auth boundary, and keep a documented fallback.

How to Pitch It (Stakeholders)

For executives: This release closes the most common enterprise blocker — "can our admins sign in with our corporate identity provider, and can we cut off access the moment someone leaves?" It ships SSO login plus centrally enforced logout for our Filament admin panels, built on an existing SSO client rather than a custom integration. Practically: it removes an objection in enterprise sales cycles at low engineering cost, and it fits the mixed-customer reality where some accounts demand SSO and others don't. Caveat to state plainly: this is a 1.0.0 from a small ecosystem, so we should treat it as a fast, reversible accelerator — not a five-year platform commitment — and validate it in one pilot tenant before making contractual SSO promises to customers.

For engineering: Scope is deliberately narrow — a Filament v3 panel integration on top of laravel-sso-client 1.1+. It adds three login behaviors (SSO button, SSO-only, forced redirect), a user-menu federated logout, and SLO enforcement on panel requests. The protocol work is upstream, so our review surface is the Filament glue: middleware ordering on panel requests, redirect-loop behavior in SSO-only mode, session invalidation correctness on SLO, and how local-password users coexist with SSO users in the same panel. Required before rollout: pin the exact version and the client version, add integration tests around the SLO path and the forced-redirect path, confirm behavior when the IdP is unreachable, and ensure we can disable the plugin via config so a bad release doesn't lock admins out of the panel. Do not extend it to SCIM or claim v4 readiness — those are not in this release.