Weave Code
Oauth2 Server Password Client Bundle Laravel Package
spomky-labs/oauth2-server-password-client-bundle
A Symfony bundle for spomky-labs/oauth2-server that adds password client support for the OAuth2 resource owner password credentials grant, helping you wire password-based token requests into your server setup with minimal configuration.
Symfony2 OAuth2 Server Configuration Bundle
Frequently asked questions about Oauth2 Server Password Client Bundle
- Is spomky-labs/oauth2-server-password-client-bundle compatible with Laravel?
- No. This is a Symfony 2 bundle that registers dependency-injection services and configuration for the Spomky-Labs OAuth2 Server Bundle, and it has no Laravel service provider, facade, or configuration path. There is no practical way to use it inside a Laravel application. For Laravel, look at Laravel Passport or league/oauth2-server instead.
- What does this bundle actually do?
- It is a thin Symfony 2 bundle that registers and configures the password client type for the Spomky-Labs OAuth2 Server Bundle, enabling the Resource Owner Password Credentials grant. Its code is mostly a DI extension, service definitions, and a configuration schema. The actual protocol behavior lives in spomky-labs/oauth2-server and the underlying password-grant library, so the bundle adds no value on its own.
- How do I install it with Composer?
- You would run composer require spomky-labs/oauth2-server-password-client-bundle, enable the bundle in your Symfony 2 AppKernel, and add the client configuration under the bundle's extension alias. Installation only resolves on the old Symfony 2.3 to 2.8 era with PHP 5.5 to 7.x. On a modern Symfony or PHP 8 runtime, expect Composer dependency resolution failures.
- Which Symfony and PHP versions does it support?
- Its Composer constraints target Symfony 2.3 to 2.8-era components and PHP 5.5 through 7.x. It is not compatible with Symfony 5, 6, or 7, nor with PHP 8.x. Symfony 2 itself reached end of life in November 2018, so there is no security patching upstream.
- Is the OAuth2 password grant still safe to use?
- The Resource Owner Password Credentials grant is deprecated in OAuth 2.1 and explicitly discouraged by the OAuth 2.0 Security Best Current Practice. It trains users to hand their credentials directly to clients and undermines MFA and SSO. Use authorization code with PKCE for user-facing flows and client credentials for machine-to-machine instead.
- Is this package still maintained?
- No. The supplied metadata shows zero stars and zero dependents, and its Symfony 2 foundation has been end-of-life since 2018. There is no upstream security patching, no CVE response process, and no community to absorb breakage. Treat it as abandoned and plan accordingly rather than assuming it will be fixed.
- What are the alternatives to this bundle?
- For embedded OAuth2 in Symfony, use league/oauth2-server with its Symfony bundle. If you need federation rather than embedding, use an external identity provider such as Keycloak, Ory Hydra, Auth0, or Entra ID. In all cases, replace the password grant with authorization code plus PKCE and retire the old flow on a dated sunset.
- What are the production and security risks of running it?
- The risk is high and mostly unmitigable: the package is unmaintained, its framework is EOL, and pinning an old exact version becomes a standing exception in dependency scanning and SBOM reviews. The deprecated password grant adds a compliance and security-review liability independent of the code quality. If it is already deployed, treat it as a decommissioning project with a named owner for the security exception.
- How should I test token requests if I keep it temporarily?
- Test the token endpoint end to end rather than the bundle's DI wiring, since the bundle only registers configuration. A password-grant request posts grant_type=password along with username, password, and client credentials, and you should assert success and failure paths including expired or invalid clients. If you are replacing it, write those same contract tests against the replacement server so migration can be verified.
- Why am I getting Composer dependency resolution errors when installing it?
- Its constraints pull in Symfony 2.3 to 2.8 components and PHP 5.5 to 7.x, along with a large, old transitive graph of OAuth2 server and grant libraries. Those requirements conflict with modern Symfony and PHP 8, so Composer cannot resolve a set. If a legacy footprint genuinely requires it, isolate it in a separate application or container and vendor the source rather than installing it alongside a current stack.
Weaver
How can I help you explore Laravel packages today?