PHPackages anzusystems/auth-bundle - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. anzusystems/auth-bundle ActiveSymfony-bundle[Authentication & Authorization](/categories/authentication) anzusystems/auth-bundle ======================= Anzu authorization services 5.0.0(6mo ago)119.0k↓30.5%Apache-2.0PHPPHP >=8.4 Since Jan 4Pushed 1w ago6 watchersCompare [ Source](https://github.com/anzusystems/auth-bundle)[ Packagist](https://packagist.org/packages/anzusystems/auth-bundle)[ RSS](/packages/anzusystems-auth-bundle/feed)WikiDiscussions main Synced 2w ago READMEChangelog (10)Dependencies (10)Versions (29)Used By (0) AnzuSystems Auth Bundle by Petit Press a.s. ([www.sme.sk](http://www.sme.sk)) ============================================================================= [](#anzusystems-auth-bundle-by-petit-press-as-wwwsmesk) Provides authorization functionality among Anzusystems' projects. --- Installation ------------ [](#installation) From within container execute the following command to download the latest version of the bundle: ``` $ composer require anzusystems/auth-bundle --no-scripts ``` ### Step 3: Use the Bundle [](#step-3-use-the-bundle) Configure the `AnzuAuthBundle` in `config/anzu_systems_auth.yaml`: ``` anzu_systems_auth: cookie: domain: .anzusystems.localhost secure: false # use true for PROD environment! jwt: audience: anz algorithm: ES256 # enum (ES256|RS256), default "ES256" public_cert: '%env(base64:AUTH_JWT_PUBLIC_CERT)%' # string representation of a public certificate private_cert: '%env(base64:AUTH_JWT_PRIVATE_CERT)%' # string representation of a private certificate authorization: enabled: true refresh_token: storage: redis: service_id: SharedTokenStorageRedis # service id of \Redis instance auth_redirect_default_url: http://admin-dam.anzusystems.localhost auth_redirect_query_url_allowed_pattern: '^https?://(.*)\.anzusystems\.localhost(:\d{2,5})$' type: json_credentials ``` Configure the [SecurityBundle](https://symfony.com/doc/current/reference/configuration/security.html) in `config/security.yaml`: ``` security: providers: app_user_provider_email: entity: class: App\Entity\User property: email auth: pattern: ^/api/auth/ stateless: true provider: app_user_provider_email json_login: check_path: auth_login success_handler: AnzuSystems\AuthBundle\Security\AuthenticationSuccessHandler failure_handler: AnzuSystems\AuthBundle\Security\AuthenticationFailureHandler logout: path: auth_logout access_control: - { path: ^/api/auth/, roles: PUBLIC_ACCESS } ``` Configure routing: ``` $routes ->import('@AnzuSystemsAuthBundle/Controller/Api/JsonCredentialsAuthController.php', type: 'attribute') ->prefix('/api/auth/'); ``` Personal access tokens ---------------------- [](#personal-access-tokens) Opt-in personal access token (PAT) authentication: an sha256-hashed bearer token bound to a user, with expiration, revocation, cached authentication, expiry notifications and management API. Disabled by default — a project that does not enable it needs no schema or configuration changes after a bundle upgrade. Enable it by subclassing the mapped superclass and pointing the config to it: ``` use AnzuSystems\AuthBundle\Domain\PersonalAccessToken\Repository\PersonalAccessTokenRepository; use AnzuSystems\AuthBundle\Entity\AbstractPersonalAccessToken; use Doctrine\ORM\Mapping as ORM; #[ORM\Entity(repositoryClass: PersonalAccessTokenRepository::class)] #[ORM\Table(name: 'personal_access_token')] #[ORM\Index(name: 'IDX_revokedAt_expiresAt', fields: ['revokedAt', 'expiresAt'])] #[ORM\UniqueConstraint(name: 'UNIQ_tokenHash', fields: ['tokenHash'])] class PersonalAccessToken extends AbstractPersonalAccessToken { } ``` ``` anzu_systems_auth: personal_access_token: enabled: true entity_class: App\Domain\PersonalAccessToken\Entity\PersonalAccessToken user_entity_class: App\Domain\User\Entity\User auth_cache_pool: 'some_redis.cache' ``` The `user` relation targets `AnzuSystems\Contracts\Entity\AnzuUser` — make sure doctrine `resolve_target_entities` maps it to the project user class. Add the doctrine mapping for the bundle's `Entity`namespace and generate the migration with `doctrine:migrations:diff`. `user_entity_class` must name the same class as the common-bundle `settings.user_entity_class` — the authenticator and `CurrentAnzuUserProvider` would otherwise load different user classes. The entity relies on constructor-less proxies, so use doctrine/orm 3 (lazy ghosts); the ORM 2 legacy proxy strategy conflicts with the final entity constructor. Wire the authenticator into a firewall protecting the API that accepts the tokens: ``` security: firewalls: mcp: pattern: ^/api/mcp stateless: true provider: app_user_provider_id entry_point: AnzuSystems\AuthBundle\Security\Authentication\PersonalAccessTokenAuthenticator custom_authenticators: - AnzuSystems\AuthBundle\Security\Authentication\PersonalAccessTokenAuthenticator ``` Management API routes (list/create/revoke) are provided by `AnzuSystems\AuthBundle\Controller\Api\PersonalAccessTokenController` attribute routes — import them with a prefix: ``` $routes ->import('@AnzuSystemsAuthBundle/Controller/Api/PersonalAccessTokenController.php', type: 'attribute') ->prefix('/api/adm/v1'); ``` Authorization uses the `auth_personalAccessToken_(create|read|revoke)` permissions (see `AnzuSystems\AuthBundle\Security\PersonalAccessTokenPermission`); creation additionally requires the role configured via `create_role` (default `ROLE_MCP`). Console commands: - `anzu:personal-access-token:create --name= [--expires-at=...]` — prints the plaintext token once. - `anzu:personal-access-token:notify-expiring` — daily cron; notifies owners of tokens expiring in 7 days or 1 day through `PersonalAccessTokenExpiryNotifierInterface` (no-op by default — alias your own implementation). The final-notice windows of consecutive runs overlap, so the implementation must be idempotent per (token, daysRemaining) pair — e.g. dispatch under an event name containing both. When migrating from an app-level PAT implementation, rename existing permission grants to the `auth_personalAccessToken_*` keys — grants stored under the old keys stop matching silently. ### Health Score 55 — FairBetter than 97% of packages Maintenance85 Actively maintained with recent releases Popularity28 Limited adoption so far Community18 Small or concentrated contributor base Maturity75 Established project with proven stability Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~49 days Recently: every ~37 days Total 24 Last Release 186d ago Major Versions 1.6.0 → 2.0.02024-05-14 2.2.0 → 3.0.02025-03-03 3.0.1 → 4.0.02025-04-17 4.4.0 → 5.0.02026-02-13 PHP version history (4 changes)1.0.0PHP >=8.1 2.0.0PHP >=8.2 3.0.0PHP >=8.3 5.0.0PHP >=8.4 ### Community Maintainers ![](https://avatars.githubusercontent.com/u/19769026?v=4)[Ronald Márföldi](/maintainers/marforon)[@marforon](https://github.com/marforon) ![](https://avatars.githubusercontent.com/u/18593654?v=4)[Lubomir Stanko](/maintainers/stankolubomir)[@stankolubomir](https://github.com/stankolubomir) ![](https://www.gravatar.com/avatar/6e0eb41fcebd2cea5ea138010e8e7782bb92ad57037aa0652ec18d15661ae3f3?d=identicon)[PetitPress a.s.](/maintainers/PetitPress%20a.s.) ![](https://avatars.githubusercontent.com/u/8159836?v=4)[TomasHermanek](/maintainers/TomasHermanek)[@TomasHermanek](https://github.com/TomasHermanek) --- Top Contributors [![marforon](https://avatars.githubusercontent.com/u/19769026?v=4)](https://github.com/marforon "marforon (15 commits)")[![scaree](https://avatars.githubusercontent.com/u/39349298?v=4)](https://github.com/scaree "scaree (10 commits)")[![pulzarraider](https://avatars.githubusercontent.com/u/960844?v=4)](https://github.com/pulzarraider "pulzarraider (8 commits)")[![sakulb](https://avatars.githubusercontent.com/u/95277083?v=4)](https://github.com/sakulb "sakulb (7 commits)")[![stankolubomir](https://avatars.githubusercontent.com/u/18593654?v=4)](https://github.com/stankolubomir "stankolubomir (7 commits)")[![TomasHermanek](https://avatars.githubusercontent.com/u/8159836?v=4)](https://github.com/TomasHermanek "TomasHermanek (2 commits)") --- Tags symfonyauthorizationanzusystems ### Code Quality Static AnalysisPsalm Code StyleECS Type Coverage Yes ### Embed Badge ![Health badge](/badges/anzusystems-auth-bundle/health.svg) ``` [![Health](https://phpackages.com/badges/anzusystems-auth-bundle/health.svg)](https://phpackages.com/packages/anzusystems-auth-bundle) ``` ### Alternatives [league/oauth2-server A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API. 6.7k151.3M327](/packages/league-oauth2-server)[scheb/2fa Two-factor authentication for Symfony applications (please use scheb/2fa-bundle to install) 589701.7k2](/packages/scheb-2fa)[scheb/2fa-trusted-device Extends scheb/2fa-bundle with trusted devices support 366.0M40](/packages/scheb-2fa-trusted-device)[amocrm/amocrm-api-library amoCRM API Client 185819.8k6](/packages/amocrm-amocrm-api-library)[fleetbase/core-api Core Framework and Resources for Fleetbase API 1239.7k25](/packages/fleetbase-core-api)[drenso/symfony-oidc-bundle OpenID connect bundle for Symfony 97795.4k4](/packages/drenso-symfony-oidc-bundle) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)