- How do I install and configure Laravel SSO Client?
- Install it with Composer using composer require jeffersongoncalves/laravel-sso-client, then publish the package config and set your SSO server endpoints and credentials. Add the package guard and middleware to your auth configuration so it plugs into Laravel's native authentication flow. The package keeps your application's own session and user model, so no rewrite of existing auth code is required.
- Which Laravel versions does Laravel SSO Client support?
- The package advertises Laravel 9+ support and is tested against PHP 8.4 and Laravel 13 across SQLite, MySQL and PostgreSQL. It also has interop tests against laravel-sso-server 1.1.0. If you are on an older Laravel or PHP version, confirm the supported range before assuming parity with the tested matrix.
- Does Laravel SSO Client work with my existing user model and session?
- Yes. The package hooks into Laravel's native auth system and leaves your application responsible for its own session and user model. On first login it automatically provisions a local user from the SSO response, and subsequent logins link to that user. Framework-native events are fired on login so you can hook in your own logic.
- How do I set up federated logout with Laravel SSO Client?
- You need laravel-sso-server 1.1 or newer, because version 1.1.0 of the client requires it for true federated logout. Add a logout endpoint such as /sso/logout to your endpoints config and set SSO_POST_LOGOUT_REDIRECT_URI to a same-origin landing page. Then change your logout UI from a GET link or a direct Auth::logout() call to a CSRF-protected POST form targeting route('sso-client.logout').
- Is the access token exposed when it is sent as token_hint on logout?
- That depends on how token_hint is transmitted. If it is appended as a query parameter, it can leak through browser history, referrer headers, proxy logs and monitoring systems that capture URLs. Before using federated logout in production, confirm that the token is sent in a POST body, is short-lived or single-use, and is stored encrypted if it is persisted between login and logout.
- What happens if the SSO server is still on 1.0.x after I upgrade the client?
- The client degrades gracefully to local-only logout, so users are signed out of your application but the central session is not terminated. Federated logout will also be inert for users who signed in before the upgrade until they re-authenticate. Upgrade laravel-sso-server to 1.1 or later first, and communicate the re-authentication requirement to avoid support tickets.
- Why are existing users locked out after enabling email_verified account linking?
- Version 1.1.0 changes account-linking semantics when the SSO server emits an email_verified claim. In legacy email-only mode, the client can refuse to link existing users whose emails are not verified, which is a lockout vector for users who could previously sign in. Review the link_existing_users_by_email setting and confirm that your server sends a strict boolean true rather than a truthy string or integer.
- What are the alternatives to Laravel SSO Client for single sign-on?
- Alternatives depend on your identity provider and protocol. Laravel Socialite is a common choice for OAuth-based providers, while SAML and OpenID Connect packages suit enterprise identity providers. Laravel SSO Client is specifically designed to pair with laravel-sso-server and to stay close to Laravel's native guard, middleware and session model.
- How should I test SSO login and logout in a Laravel application?
- Write feature tests around your guard, middleware and the sso-client.logout POST route, and assert that framework-native login events fire as expected. Run the suite against SQLite, MySQL and PostgreSQL if you support multiple databases, and include interop tests against laravel-sso-server 1.1.0. Also test the older-server path so you know how the client behaves when federated logout is unavailable.
- Is Laravel SSO Client maintained and compatible with server 1.1.x?
- Release 1.1.0 is explicitly coupled to laravel-sso-server 1.1 or newer for federated logout, while the client still supports older servers with local-only logout. The package is a thin, conventional Laravel package with routes, config and middleware, so it fits standard applications without architectural change. Check the repository for the current support policy and confirm how long client 1.1.x will remain compatible with server 1.0.x.