- What is jeffersongoncalves/filament-sso-server and what does it do?
- It is a Filament plugin that adds a UI for managing OAuth clients and active sessions for the jeffersongoncalves/laravel-sso-server package. Instead of your Filament panel consuming an identity provider, the panel becomes the identity provider and issues OAuth2 tokens so other applications can authenticate users against it. You get Filament-native screens for onboarding relying parties, managing scopes, and revoking sessions. It is early-stage software with a single maintainer, so treat it as pre-adoption until you have reviewed it.
- How do I install filament-sso-server in a Laravel Filament panel?
- Run composer require jeffersongoncalves/filament-sso-server, then publish and review the config and migrations before running them. You also need Passport signing keys generated and the plugin registered on a panel provider so the management screens appear in your admin panel. Budget roughly one to two engineer-days to reach a working staging flow with a single relying party, most of which is security review rather than installation.
- Does filament-sso-server require Laravel Passport?
- Yes. The package manages the clients and sessions of laravel-sso-server, which uses Laravel Passport's OAuth2 authorization server as its engine. That means Passport must already be, or become, a dependency of your application. Confirm that Passport is shared with your existing install rather than bundled, because a duplicate Passport install or a diverging version pin is the most likely early integration failure.
- Which Laravel, Filament, and PHP versions does filament-sso-server support?
- The package assumes a modern Laravel 10 or 11 application with Filament v3 and a compatible Passport release, and PHP 8.2 or newer is a reasonable floor. The published support matrix is thin, so verify the constraints in composer.json rather than inferring them. Treat Filament major upgrades as potentially breaking for this plugin, since plugin APIs churn across Filament majors even at a 1.0.x version.
- Does filament-sso-server support OpenID Connect or only OAuth2?
- What is documented is OAuth2 authorization-server behaviour inherited from Passport. Full OIDC features such as id_token issuance, a discovery document, and a userinfo endpoint are not clearly evidenced, so treat them as unproven until you verify conformance yourself. That distinction matters if third-party or non-Laravel relying parties need a standards-certified OIDC provider.
- How are client secrets stored and rotated, and are redirect URIs validated?
- These are questions you must answer from the source code before production use, because the package does not document them clearly. Check that client secrets are hashed at rest, that rotation is supported, that redirect URIs are matched strictly rather than by prefix, and that grants are limited to authorization code with PKCE. If any of that is missing, do not expose the panel to untrusted relying parties.
- Is filament-sso-server safe to run in production?
- Not without a deliberate security review. A defect in this package is not a broken admin page but a lockout or unauthorized-access event across every connected application, and at 1.0.1 with one star, one maintainer, and no visible security disclosure policy it is pre-adoption software. Adopt it on a non-production panel first, keep signing keys in a secrets manager rather than on disk or in a container image, and only enable it on production admin traffic once key custody and token lifetimes are decided.
- What changed between filament-sso-server 1.0.0 and 1.0.1, and should I pin the version?
- The 1.0.1 release is undocumented beyond a compare link, so it does not state whether migrations, config keys, routes, or token and session semantics changed, or whether the patch is security-relevant. On an authentication package, a patch bump is a stop-and-read-the-diff event. Pin exactly 1.0.1 in composer.json with a committed lockfile and review the diff before upgrading, rather than floating on a caret constraint.
- How do I test the filament-sso-server login flow end to end?
- Install into a staging environment, publish and read the migrations, generate Passport keys, then onboard one low-risk internal relying party and walk the full authorization-code flow including login, token refresh, and logout. Verify that revoking a session in the Filament UI actually terminates access at the relying party. Keep this off any panel that already serves production admin traffic until a runbook exists for the auth surface you have just created.
- What are the alternatives to filament-sso-server?
- If you need a hardened, standards-certified identity provider, use Keycloak, Entra ID, or another established IdP and keep your Filament panel as a consumer. If you only want OAuth2 tokens from your Laravel application, you can use Laravel Passport directly or install jeffersongoncalves/laravel-sso-server without the Filament management UI. This package's value is purely the Filament-native admin experience for clients and sessions when your panel already holds the user records.