Weave Code
Composite Password Authentication Bundle Laravel Package
phpmentors/composite-password-authentication-bundle
A Symfony bundle for composite password authentication, enabling flexible login flows where multiple password-based credentials or conditions are combined within Symfony’s security system. Supports custom authentication policies and integration.
A Symfony bundle for authentication using composite password
Frequently asked questions about Composite Password Authentication Bundle
- Is phpmentors/composite-password-authentication-bundle a Laravel package?
- No. It is a Symfony bundle, not a Laravel package, and it relies on Symfony bundle registration, the Symfony DI container, and the Security component. Laravel does not have a direct insertion point for those conventions, so it cannot be installed as a normal Laravel Composer dependency with a service provider.
- What does CompositePasswordAuthenticationBundle actually do?
- The overview describes a Symfony bundle that lets one login form authenticate against multiple password sources, such as a database, LDAP directory, or in-memory user. You register several Symfony user providers and the bundle resolves credentials against each in turn with configurable order and priority. It reuses standard password authentication rather than adding custom login logic.
- Does this package support Laravel 9, 10, or 11?
- There is no evidence of Laravel support. The package is a Symfony bundle with a single v1.0.0 release dated 2016-10-31, so its Composer constraints will be Symfony 2/3-era and PHP 5/7-era. Expect conflicts with modern Laravel and PHP 8.x, and do not assume it can be installed in a Laravel 9/10/11 application.
- Is phpmentors/composite-password-authentication-bundle still maintained?
- No active maintenance is evident. The assessment notes a single release in roughly a decade, no dependents, no ecosystem validation, and no active maintainer. A first release from 2016 is not a mature 1.x with a patch history, so there is no evidence of post-release bug fixing or security review.
- Can I use this bundle with Laravel's Auth guard or a custom UserProvider?
- Not directly. Laravel's guard/provider/password-broker stack has no direct insertion point for a Symfony bundle's DI container and Security component conventions. If you need the behavior, the defensible path is to reimplement the required provider-chaining logic natively in a Laravel custom UserProvider or guard, using the bundle only as a behavioral reference.
- What is the package identity issue with v1.0.0?
- The v1.0.0 release metadata reportedly names PHPMentorsRouteTemplatingBundle, a route-templating bundle, rather than an authentication or composite-password package. That mismatch means the artifact's identity must be confirmed before any further evaluation. Until then, you cannot assume it implements password composition at all.
- What are the security risks of adopting this package?
- The assessment rates technical risk as high: the package is abandoned, has no dependents or ecosystem validation, no active maintainer, and no modern security review, with a health score of 0.26. Adopting a ten-year-old single-release artifact into an auth-adjacent path would be a supply-chain and security decision made on essentially no evidence. Do not adopt it as a production dependency.
- What alternatives should I use for multi-source authentication in Laravel?
- Use Laravel-native building blocks: the standard auth guard, a custom UserProvider, validation rules, or Laravel Fortify for authentication flows. For LDAP or external directories, evaluate maintained Laravel-specific packages or a small in-house provider that chains sources explicitly. A small Laravel-native implementation with tests and security review is safer than bridging an abandoned Symfony bundle.
- How would I migrate a Symfony app using this bundle to Laravel?
- There is no migration path available on the evidence provided. The prior assumption that credential-composition logic could be extracted and called from a Laravel guard or UserProvider is unvalidated, especially given the package identity ambiguity. The only defensible approach is to reimplement the required behavior natively in Laravel, using the bundle at most as a behavioral reference.
- What should I check before evaluating this package further?
- First confirm which package is actually under review and whether PHPMentorsRouteTemplatingBundle is the artifact behind the original composite-password assessment. Then clarify what composite password means in your requirement: multiple password fields, multiple hashes per user, MFA, or step-up authentication. Also check supported Symfony and PHP versions, the threat model, compliance needs, and who would own a fork.
Weaver
How can I help you explore Laravel packages today?