- Is nti/keycloak-security-bundle a Laravel package or a Symfony bundle?
- It is a Symfony bundle, not a Laravel package. It plugs into the Symfony Security component as a firewall authenticator and delegates identity to Keycloak over OIDC/OAuth2. For a Laravel application there is no native integration, and writing a framework shim is more work than using a Laravel-native OIDC or Socialite provider.
- How do I install and configure nti/keycloak-security-bundle?
- Install it with Composer, register the bundle in config/bundles.php, add client settings (often a keycloak.json-style file or services.yaml entries), and add a firewall authenticator to security.yaml. The package itself is small; most of the effort is Keycloak-side realm and client provisioning, redirect URI registration, and claim mapping.
- Which Symfony and PHP versions does this Keycloak bundle support?
- The bundle targets Symfony 5/6-era applications and delegates to the Symfony Security component. Compatibility with Symfony 7 and newer PHP versions is unverified, so pin the bundle, Symfony, and PHP to tested versions in your lockfile. Treat newer Symfony majors as unsupported until you run a spike.
- Which Keycloak versions does this bundle work with?
- It was built against older Keycloak releases; since Keycloak 17+ (Quarkus distribution) default endpoints and claim behavior have shifted. Compatibility with Keycloak 22+/24+ is unverified and should be assumed unsupported until tested, including introspection, refresh, and back-channel logout. Confirm against your IdP estate before adopting.
- What license does nti/keycloak-security-bundle use and can I use it commercially?
- The bundle is GPL-3.0, a strong copyleft license. Distributing a product that links it can trigger source-disclosure obligations for the combined work, so commercial or distributed use needs legal sign-off and may require a fork-and-relicense or replacement. In many enterprise portfolios this alone is a blocker.
- How does Keycloak role and claim mapping work in this bundle?
- Role mapping is handled by reading Keycloak role or group claims and translating them into Symfony security roles via bundle configuration. You must decide the claim shape (realm roles vs client roles vs groups) in Keycloak and map it consistently. The bundle does not solve Keycloak-side role design for you.
- Is nti/keycloak-security-bundle actively maintained?
- Maintenance signals are weak: about 2 stars, 0 dependents, a single vendor, and a last release around April 2024. That looks like an internal tool published publicly, with a bus factor of one and no evident CVE response process. For authentication code, that abandonment risk is significant.
- How do I set up Keycloak logout and single logout with this bundle?
- Logout typically requires wiring the bundle's logout handler and registering valid post-logout redirect URIs in the Keycloak client. Back-channel or single logout depends on Keycloak client settings and the bundle's support for those flows, which is not clearly verified. Test logout and session invalidation explicitly in staging.
- What are the best alternatives for Keycloak SSO in Laravel or Symfony?
- For Laravel, use a Socialite Keycloak provider or a maintained generic OIDC client; do not bridge this Symfony bundle. For Symfony, consider knpuniversity/oauth2-client-bundle with a generic provider or web-token/jwt-bundle for token validation. Choose a maintained OIDC client if your requirement is SSO rather than Keycloak-specific federation.
- How do I test Keycloak OIDC integration safely in staging and production?
- Start with a short spike on a throwaway environment: provision a test realm and client, register redirect URIs, and verify TLS trust for the IdP certificate, which is a common staging-vs-production failure. Then run dual authentication behind a feature flag, cut over by user cohort, and decommission local credentials only after a session-drain window.