Laravel Filament Sso Laravel Package

Product Decisions This Supports

• Build vs. buy for admin-panel auth. This is a "buy" answer for one specific slice of the stack: Microsoft 365 sign-in for Filament panels via the Postiefs SSO portal. It removes the need to hand-roll an OIDC/SAML flow, session guards, and Livewire request coverage, which is typically 2–4 weeks of engineering plus ongoing security maintenance. The trade is a firm dependency on both Filament and the Postiefs portal.
• Feature scoping for enterprise onboarding. "Sign in with Microsoft 365" on the login form, automatic redirect to the portal, and portal-driven session enforcement on every panel request (including Livewire updates) map directly to the security questionnaire items enterprise buyers ask about: SSO enforcement, session revocation, and no unauthenticated Livewire round-trips.
• Break-glass / availability design. redirectLogin() and allowLocalLogin() with ?local=1 is an explicit product decision already made for you: SSO-first with a documented escape hatch when the portal is down. Decide now whether that escape hatch is on for all environments or gated (env flag, IP allowlist, rate limiting, alerting on use) — this is the single highest-risk surface in the release.
• Authorization ownership. The package deliberately authorises against your app's own roles (e.g. Spatie) and never applies portal roles. That keeps least-privilege and permission modelling inside your product, and means identity (portal) and entitlement (your app) stay cleanly separated. Roadmap implication: you still need a provisioning path for roles — SCIM, admin invitation, or first-login defaults — since SSO alone will not populate them.
• Multi-panel / multi-audience roadmap. The plugin is added per panel provider, but after callback users land on the "default panel". If you run more than one panel (e.g. internal admin vs. customer), preserving the intended destination becomes a product gap to schedule, not a bug to discover post-launch.
• Logout UX and session semantics. Portal sessions signing out to the launchpad versus local logins signing out as before is a real UX difference your support docs and QA scripts need to encode.

When to Consider This Package

Adopt when all of the following hold:

• You are on Filament 3+ on a supported Laravel version, and the panel is the primary surface you are protecting.
• You are already a Postiefs SSO portal customer, or are actively choosing it — this package is a client for that portal, not a general-purpose SSO library.
• Microsoft 365 / Entra ID is your identity provider of record, and you want SSO enforced rather than offered.
• Your authorization model lives in the app (Spatie or equivalent) and you are comfortable keeping entitlement provisioning separate from authentication.
• You have a plan for the ?local=1 break-glass path.

Look elsewhere when:

• You are not on Filament, or you need SSO for non-panel surfaces (public API, mobile, CLI) — reach for postiefs/laravel-sso directly or a broader identity package.
• Your IdP mix is heterogeneous (Okta, Google Workspace, SAML-only customers) or you need per-tenant IdP configuration. A portal-mediated design may not fit, and a dedicated SSO/identity product is the better bet.
• You need IdP group/role claims to drive in-app authorization automatically — this package explicitly won't do that.
• You require vendor-neutral, self-hosted, or open-source-only dependencies, or you cannot accept single-vendor risk on a v1.0.0 package.

Diligence before commit: verify the compatibility claims. The release advertises Filament 3/4/5 and Laravel 11/12/13, which is an unusually wide forward-looking matrix for a first release — confirm the CI matrix actually exercises the versions you run, and pin accordingly. Also confirm maintenance posture (release cadence, issue response, whether the portal vendor supports the plugin as part of the contract) and that postiefs/laravel-sso ^1.0 is itself maintained.

How to Pitch It (Stakeholders)

To executives: This is a small, targeted dependency that ships enterprise-grade sign-in for our admin panel without a build project. It gets us "Sign in with Microsoft 365", enforced sessions, and immediate revocation via the Postiefs portal — the controls enterprise buyers ask about — at the cost of a first-release, single-vendor dependency. Recommendation: adopt behind a time-boxed spike, with the break-glass local-login path explicitly gated and monitored, and a documented exit path (the underlying postiefs/laravel-sso works without Filament).

To engineering: Add postiefs/laravel-filament-sso and register SsoPlugin::make() on the panel provider. It puts the Microsoft 365 button under the login form, redirects to the portal, and runs the portal's session rules on every panel request including Livewire updates, plus a browser guard on every page. Authorization stays ours — app roles (Spatie) only; portal roles are never applied — so no permission model changes. Two things to own: the ?local=1 break-glass path needs environment gating, rate limiting, and alerting on use, and post-callback landing is hardcoded to the default panel, which needs fixing before we ship a second panel. Validate the Filament/Laravel version matrix in our own CI rather than trusting the release notes, and pin the version.