Product Decisions This Supports
- Vendor dependency risk review (build vs. buy for identity): This package is a case study in why identity — authentication, SSO, user directories, MFA — should be treated as a tier-0 vendor dependency with an explicit exit plan. Stormpath was acquired by Okta in 2017 and its API service was sunset; a bundle wrapping that API is now non-functional regardless of code quality. Use it as evidence in the "what happens if our IdP disappears" section of any auth build-vs-buy decision.
- Framework-fit validation for the roadmap: The package is a Symfony bundle, not a Laravel package. Any roadmap item scoped against this repo is misfiled. This assessment should trigger a correction to the intake criteria used when evaluating PHP packages — framework, runtime version, and vendor liveness checks should be gates before a package reaches PM review.
- Reference architecture, not a shipping dependency: If the team is writing its own Symfony/Laravel integration around a current identity provider (Okta, Auth0, Cognito, Keycloak, WorkOS), the bundle's service-provider/DI wiring and configuration-tree patterns are a legitimate structural reference. The value is the shape of the integration, not the code.
- Deprecation and migration planning: If any legacy Symfony application still references this bundle, that is an unowned maintenance liability and a latent auth outage. Flag it for inventory and replacement before the next security review.
- Not a signal for roadmap prioritization: 5 stars, 0 dependents, and a score of 0.125 mean there is no ecosystem, no community support, and no upstream maintenance. Do not let a "Stormpath integration" line item survive on a roadmap on the strength of this repository.
When to Consider This Package
Adoption criteria — all of which must hold, and in practice none do:
- You are maintaining a legacy Symfony application (not Laravel) that already has this bundle wired in, and you are evaluating whether to patch or replace it. Replacement is the correct answer; the underlying Stormpath API is gone.
- You need a historical worked example of how a Symfony bundle abstracts a hosted identity provider — for design reference only, never as a runtime dependency.
- You are doing post-mortem analysis on third-party SaaS risk and want a concrete artifact showing how quickly an integration becomes dead weight when the vendor exits.
Look elsewhere — decisively — when:
- You are on Laravel. This is a Symfony bundle. It will not install or boot in a Laravel application without a framework-level rewrite. There is no version of this that is a drop-in.
- You need working authentication. The Stormpath service no longer exists. There is no endpoint to authenticate against, no SDK to call, no dashboard to provision users from. The package cannot deliver its stated function.
- You need maintenance, security patches, or support. Five stars and zero dependents means no contributors, no issue triage, no CVE response. An auth dependency with no maintainer is an unacceptable risk surface.
- You are selecting an identity provider today. Evaluate Okta, Auth0, AWS Cognito, Keycloak, or WorkOS directly, and use their first-party SDKs or a maintained community package with an active release history.
- You are assessing maturity via score. 0.125 is a strong negative signal; treat it as disqualifying for anything in the auth path unless a human has independently verified the code.
How to Pitch It (Stakeholders)
To executives: This package was evaluated and is not viable. It integrates Stormpath, an identity service that was acquired and shut down in 2017 — the vendor it depends on no longer exists, so the code cannot perform its stated job. It is also built for Symfony, while our stack is Laravel. Adoption is zero (5 stars, 0 dependents), meaning no maintainer and no security response. Recommendation: reject. The relevant takeaway for leadership is process, not code: identity is a top-tier vendor dependency, and we should require every auth integration to carry a documented exit plan and a framework-fit check at intake.
To engineering: Do not add this to any dependency manifest. Two independent blockers — dead upstream service and wrong framework — plus zero maintenance. If a legacy Symfony service still references redeye/stormpath-bundle, surface it now; it represents an unmonitored authentication failure waiting to happen and should be scheduled for replacement with a current IdP. If we build our own provider integration, the bundle's DI and config-tree structure is worth ten minutes as a design reference, and nothing more.
To product: Remove any roadmap or backlog item that assumed a Stormpath integration. Re-baseline identity work against a live provider, and add framework, runtime, and vendor-liveness checks to the package intake checklist so this class of dead dependency is filtered before it consumes PM review time.