Weave Code
Laravel Oidc Laravel Package
uisits/laravel-oidc
A Laravel package for OpenID Connect (OIDC) authentication, helping you integrate external identity providers and add secure single sign-on to your application with minimal configuration.
Shibboleth OIDC driver for Laravel Socialite
Frequently asked questions about Laravel Oidc
- What is uisits/laravel-oidc used for?
- uisits/laravel-oidc is a lightweight OpenID Connect client for Laravel applications. It handles the authorization code redirect, token exchange, and ID token validation so you can authenticate users against any OIDC-compliant identity provider without writing the protocol flow yourself. It also exposes standard claims and integrates with Laravel's auth guard.
- How do I install and configure uisits/laravel-oidc in a Laravel app?
- Install the package with Composer, publish its configuration, and set your OIDC provider credentials, endpoints, scopes, and redirect URI. Then wire the package routes and middleware into your Laravel application and test against a staging identity provider. Most effort is usually IdP configuration, callback handling, session behavior, and security review rather than package installation.
- Which Laravel and PHP versions does uisits/laravel-oidc support?
- The supplied release notes do not list exact Laravel and PHP version constraints, so verify the package composer.json against your target versions. Because v3.0.3 is presented as a patch-level release from v3.0.1, do not assume compatibility from the version number alone. Review the changelog and run the same integration tests you would use for v3.0.1.
- Which OIDC identity providers work with this Laravel package?
- It should fit standards-compliant OIDC providers such as Okta, Azure AD or Entra ID, Keycloak, and Auth0. Confirm that your provider supports the authorization code flow and standard OIDC metadata. Also test provider-specific behavior around callback URLs, claims, logout, and token validation before rollout.
- Does uisits/laravel-oidc handle token validation and JWKS rotation?
- The package overview says it handles ID token validation, but JWKS caching and rotation, clock skew, refresh behavior, and logout handling are open questions that require review. Test these edge cases against your actual identity provider rather than assuming full coverage. Authentication is security-sensitive, so include them in your SSO regression tests.
- How do I protect Laravel routes with OIDC middleware?
- The package includes middleware for protecting routes and managing sessions, so you can attach it to route groups that require authentication. After login, your application can access standard claims such as email, name, and subject, and resolve users through Laravel's auth guard. Test session expiry, callback mismatches, and error paths before production use.
- Can I use uisits/laravel-oidc with multiple identity providers or multi-tenant apps?
- The package is best suited to standard OpenID Connect login against an external identity provider. The supplied assessment notes it is less suited to highly customized federation, complex multi-IdP routing, or non-standard token and session requirements without validation. Confirm multi-tenant or multi-IdP needs early before adopting it for those scenarios.
- What changed between uisits/laravel-oidc v3.0.1 and v3.0.3?
- v3.0.3 is presented only as a patch-level release from v3.0.1 with a changelog link. The supplied notes do not enumerate breaking changes, features, deprecations, or security fixes. Review the actual changelog, run a dependency audit, and repeat SSO regression tests before approving it for production.
- Is uisits/laravel-oidc safe for production authentication?
- Authentication is security-sensitive, so treat this package as infrastructure that requires review rather than a drop-in guarantee. Do not approve v3.0.3 for production until you have reviewed the changelog, dependency audit, license, maintainer responsiveness, and SSO regression tests. Pin versions, monitor IdP metadata and certificates, and keep a fallback plan for critical auth paths.
- How should I roll out OIDC login in an existing Laravel application?
- Use a parallel-run approach: add OIDC behind a feature flag, pilot with a non-critical user group, and keep existing auth fallback during rollout. Avoid migrating admin or high-privilege accounts first, and map existing claims, roles, logout behavior, and session lifetime before cutover. Test login, callback, token validation, logout, session expiry, and error paths before broad rollout.
Weaver
How can I help you explore Laravel packages today?