- Is michalkvasnicak/oauth2-server-bundle a Laravel package?
- No. It is a Symfony bundle, not a Laravel package. It ships a Symfony Bundle subclass, dependency injection extension, compiler passes, and YAML service definitions that assume Symfony's full-stack kernel and Security component. Laravel has no concept of bundles or runtime Symfony ContainerBuilder wiring, so there is no service provider, facade, or publishable config to integrate.
- Can I install michalkvasnicak/oauth2-server-bundle in Laravel 10, 11, or 12?
- It is very unlikely to resolve. The bundle targets Symfony 2.x/3.x and PHP 5.5 to 7.x constraints, while Laravel 10, 11, and 12 pin Symfony 6/7 components. Forcing resolution would mean pinning an unsupported framework version underneath your Laravel app, which is not a viable production path.
- What Composer conflict should I check before trying this OAuth2 bundle?
- Run composer why-not michalkvasnicak/oauth2-server-bundle against your target Laravel version before doing anything else. Also read its composer.json require block for symfony/symfony and php constraints. Expect a hard conflict, and document it as the artifact that closes the evaluation.
- Does this bundle support PKCE or OpenID Connect?
- No. The evaluation notes there is no PKCE or OIDC support, even though both are now table stakes for public clients and modern SSO. If you need authorization code with PKCE, OIDC, or federation, this bundle does not meet the requirement.
- Is the OAuth 2.0 library behind this bundle still maintained?
- No. The evaluation flags the underlying OAuth 2.0 core as end-of-life and archived upstream, citing bshaffer/oauth2-server-php. Inheriting an abandoned auth core inside token issuance, client authentication, and grant handling is a high-risk decision. There is also no security advisory coverage, maintenance cadence, or easy patch path without owning a fork.
- What Laravel alternatives should I use instead of this Symfony OAuth2 bundle?
- Use laravel/passport if you need a full OAuth 2.0 server, since it is built on the actively maintained league/oauth2-server and covers authorization code with PKCE, client credentials, password, refresh tokens, and scopes. Use laravel/sanctum if the real need is first-party SPA or mobile tokens rather than third-party OAuth. Use an external IdP such as Keycloak, Auth0, or Cognito if OIDC, SSO, or multi-app federation is in scope.
- Can I port this Symfony bundle into a Laravel application?
- Technically you could reimplement the DI wiring against Laravel's container and translate Symfony Security assumptions to Laravel guards, but that means maintaining a fork of an abandoned bundle on top of an abandoned library. In practice this becomes a from-scratch OAuth server with extra archaeology. A maintained Laravel solution is cheaper and safer.
- What requirements should I clarify before choosing an OAuth2 server for Laravel?
- Clarify whether the actual requirement is an OAuth 2.0 authorization server, OIDC or SSO, or just API token issuance for first-party clients. List the grant types that must be supported, such as authorization code with PKCE, client credentials, and refresh rotation. Also identify any compliance driver, such as SOC 2 or pen-test scope, that makes an unmaintained auth dependency unacceptable, and ask why this package was selected in the first place.
- Is it safe to use an abandoned OAuth2 server in production?
- No. Token issuance and client authentication are the most security-sensitive surfaces in the product, so an abandoned OAuth 2.0 server is a disqualifying risk. This bundle has no security advisory coverage, no maintenance cadence, no PKCE or OIDC support, and no path to patch a vulnerability without owning the fork. Use a maintained OAuth 2.0 implementation or an external IdP instead.
- How should I migrate a legacy Symfony app using this bundle to Laravel?
- Do not extend the existing bundle. Freeze the legacy Symfony service as-is behind its current interface, stand up laravel/passport or an external IdP for new clients, and dual-run while you reconcile the user store and token formats. Plan a cutover rather than trying to transplant the Symfony bundle's DI wiring into Laravel.