- Is rz/oauth-bundle a Laravel package?
- No. Despite being described as framework-friendly, rz/oauth-bundle is a Symfony bundle built to extend HWIOAuthBundle and integrate with RzUserBundle. It depends on Symfony's DI container, bundle registration, security firewall, and event system, none of which exist in Laravel. It should not be listed as a Laravel integration package in any roadmap or vendor comparison.
- Can I install rz/oauth-bundle in a Laravel application?
- You can run composer require rz/oauth-bundle, but it will not function in Laravel. There is no service provider, no config publishing, and no Laravel auth guard integration, so the OAuth flow never wires itself into the framework. Making it work would require an adapter layer that costs more than reimplementing the flow with Laravel Socialite.
- What is the Laravel equivalent of rz/oauth-bundle?
- Laravel Socialite ships with the framework and covers the same job: provider configuration, authorization redirects, and callback token exchange. For providers Socialite does not support, use a maintained generic OAuth 2.0 client such as league/oauth2-client with a small custom driver. Porting the equivalent logic from this bundle to Socialite is typically only a few dozen lines.
- Is rz/oauth-bundle still maintained?
- The repository is archived with zero stars and zero dependents, so there are no security patches, compatibility updates, or issue triage. There is also no maintainer to escalate a vulnerability to. For an authentication boundary, an unmaintained package is a hard stop rather than a style concern.
- Which Symfony versions does rz/oauth-bundle support?
- The bundle targets Symfony 2 and 3-era applications that use HWIOAuthBundle and RzUserBundle, and it pins against those parent packages. Both parents are effectively end of life, with HWIOAuthBundle superseded by Symfony's authenticator system and league/oauth2-client. Check the composer.json constraints before assuming compatibility with any newer Symfony release.
- Why do I get service not found errors when using rz/oauth-bundle?
- The bundle has no standalone behavior. It requires a configured HWIOAuthBundle firewall and RzUserBundle in the same application, and without them it fails with service not found errors. Those errors misdirect debugging toward bundle registration instead of the real missing firewall configuration keys.
- How do I migrate from rz/oauth-bundle to Laravel Socialite?
- Map each configured provider to a Socialite driver with its client ID, client secret, and redirect URI, then replace the bundle's redirect and callback handling with Socialite's redirect() and user() calls. Identity mapping moves to your own user provisioning logic rather than RzUserBundle. Keep the bundle only as read-only reference material during the migration, and confirm it is not still required transitively before removing it.
- Is rz/oauth-bundle safe to use in production for OAuth?
- OAuth flows, token handling, and identity mapping are a security boundary, and this package has no remediation path when a CVE lands. With an archived repository, no maintainer, and deprecated parent packages, there is no one to ship a fix. New adoption should be rejected outright; existing legacy Symfony installs should be forked or vendored under explicit internal ownership with a funded removal date.
- Does rz/oauth-bundle support multiple OAuth providers?
- Yes, it offers pluggable provider configuration and an extensible structure for custom providers, but only inside a Symfony application running HWIOAuthBundle resource owners. The provider abstraction is tied to Symfony's firewall and DI container, so it is not reusable in Laravel. In Laravel, Socialite plus a custom driver is the supported way to handle multiple providers.
- What should a team do if rz/oauth-bundle is already in a codebase?
- First confirm whether it is in production or only under evaluation; if it is only under evaluation, stop there. Then inventory the pinned PHP, Symfony, HWIOAuthBundle, and RzUserBundle versions and check whether the package is a direct or transitive requirement. Isolate it behind an application-level auth adapter so replacement is a contained change, assign a named owner for security triage, and set a removal date.