PHPackages creativecrafts/laravel-sso - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. creativecrafts/laravel-sso ActiveLibrary[Authentication & Authorization](/categories/authentication) creativecrafts/laravel-sso ========================== Multi-tenant SSO package for Laravel supporting OIDC and SAML 2.0 with provisioning, multiple guards, and optional Inertia admin UI. 1.0.4(1mo ago)1478MITPHPPHP ^8.3CI passing Since Jul 2Pushed 1mo ago1 watchersCompare [ Source](https://github.com/CreativeCrafts/laravel-sso)[ Packagist](https://packagist.org/packages/creativecrafts/laravel-sso)[ Docs](https://github.com/creativecrafts/laravel-sso)[ GitHub Sponsors]()[ RSS](/packages/creativecrafts-laravel-sso/feed)WikiDiscussions main Synced 1w ago READMEChangelog (5)Dependencies (16)Versions (6)Used By (0) Multi-tenant SSO (OIDC + SAML 2.0) for Laravel ============================================== [](#multi-tenant-sso-oidc--saml-20-for-laravel) [![Latest Version on Packagist](https://camo.githubusercontent.com/a0c1ed38988fc91830e5448372b84025a51d31b186de5aed78d449b11e980d2f/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f63726561746976656372616674732f6c61726176656c2d73736f2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/creativecrafts/laravel-sso)[![GitHub CI Status](https://camo.githubusercontent.com/d25a94ac64e8efedc78a28e9a238d76178277ad834ff1622ee0a5143dceba7b1/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f63726561746976656372616674732f6c61726176656c2d73736f2f63692e796d6c3f6272616e63683d6d61696e266c6162656c3d6369267374796c653d666c61742d737175617265)](https://github.com/creativecrafts/laravel-sso/actions/workflows/ci.yml)[![Total Downloads](https://camo.githubusercontent.com/e4e28aad2ec1360891e775bbc1d7b505cca83ec5ae84dd2e78bf9b3406376d7b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f63726561746976656372616674732f6c61726176656c2d73736f2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/creativecrafts/laravel-sso) Generic OIDC and SAML 2.0 SSO for Laravel, with multi-tenant support, user provisioning, identity linking, redacted audit logging, replay prevention, and configurable throttling on public SSO endpoints. Compatibility ------------- [](#compatibility) This package supports the runtime constraints declared in `composer.json`: - PHP `^8.3` (8.3, 8.4, 8.5) - Laravel / Illuminate `^12.0|^13.0` CI validates PHP 8.3–8.5 across Laravel 12 and 13. See `composer.json` for authoritative constraints. Documentation ------------- [](#documentation) GuideDescription[Getting Started](docs/getting-started.md)Install → first OIDC login[Configuration Reference](docs/configuration-reference.md)All config keys, env vars, IdP JSON shapes[Integration Guide](docs/integration-guide.md)Policies, events, tenancy, guards, extension[Admin API](docs/admin-api.md)JSON admin API + UI scaffold[Operator Guide](docs/operator-guide.md)Production operating model[Deployment Guide](docs/deployment-guide.md)Staging/production checklist[Security Guide](docs/security.md)Hardening and operational security[Troubleshooting Guide](docs/troubleshooting.md)Common issues[Error Catalog](docs/error-catalog.md)Exceptions and HTTP status mapping[Upgrade Guide](docs/upgrade-guide.md)Migration and rollout notes[Auth Attempt Lifecycle](docs/auth-attempt-lifecycle.md)Callback state machine[Database Schema](docs/database-schema.md)Tables, columns, indexes, relationships[Architecture Audit](docs/architecture-audit.md)Design boundaries and limitations[Maintainer Release Checklist](docs/maintainer-release-checklist.md)Release gates[Contributor Matrix Testing](docs/contributor-matrix-testing.md)Local PHP/Laravel matrixInstallation ------------ [](#installation) ``` composer require creativecrafts/laravel-sso php artisan sso:install --run-migrations ``` `sso:install` publishes config (`sso-config`), migrations (`sso-migrations`), and optional UI assets (`sso-ui`). Manual publish: ``` php artisan vendor:publish --tag=sso-config php artisan vendor:publish --tag=sso-migrations php artisan migrate ``` Database foundation ------------------- [](#database-foundation) Published migrations create: - tenants - identity providers - connections - auth attempts - external identities - audit logs Do not treat the database layer as optional. Quick start ----------- [](#quick-start) ``` php artisan sso:make-tenant "Acme Corp" php artisan sso:make-idp {tenant_ulid} "Acme OIDC" --protocol=oidc php artisan sso:make-connection {tenant_ulid} {idp_id} "Acme Connection" php artisan sso:doctor --strict ``` Configure IdP credentials (admin API or tinker), then add a login button using **connection ULID**: ``` ``` Full walkthrough: [Getting Started](docs/getting-started.md). Public SSO routes ----------------- [](#public-sso-routes) ``` GET /sso/{tenant_ulid}/{connection_ulid}/redirect GET /sso/{tenant_ulid}/{connection_ulid}/callback (OIDC) POST /sso/{tenant_ulid}/{connection_ulid}/acs (SAML) GET /sso/{tenant_ulid}/{connection_ulid}/metadata (SAML SP) ``` Optional: `?redirect_to=/dashboard` on the redirect route (validated for safety). Helper: `sso_redirect_url($tenantUlid, $connectionUlid, $redirectTo = null)`. Provisioning and identity linking --------------------------------- [](#provisioning-and-identity-linking) Provisioning and identity linking are **deny-by-default**. A successful callback creates or links a local user only when: 1. the host binds custom `ProvisioningPolicy` / `IdentityLinkPolicy` implementations, **or** 2. package-wide defaults are enabled in `config/sso.php`, **or** 3. the connection opts in via `sso_connections.settings` Connection settings override package defaults: ``` $connection->settings = [ 'allow_provisioning' => true, 'allow_identity_linking' => true, ]; ``` Claim-aware example policies: `GroupRequiredProvisioningPolicy`, `GroupRequiredIdentityLinkPolicy`. See [Integration Guide](docs/integration-guide.md). Admin API and UI scaffold ------------------------- [](#admin-api-and-ui-scaffold) The **JSON admin API** manages tenants, identity providers, and connections. Enable with `SSO_UI_ENABLED=true` and register a `manageSso` gate. An optional **Inertia UI scaffold** can be published (`sso-ui` tag); full CRUD screens are host-app responsibility. Details: [Admin API](docs/admin-api.md). Security highlights ------------------- [](#security-highlights) - IdP URL trust policy (HTTPS, no private hosts by default, DNS-checked outbound calls) - OIDC: PKCE S256, nonce, RS256 JWKS validation, encrypted PKCE verifiers - SAML: strict XML shapes, signature validation, optional AuthnRequest signing (fail-closed) - Auth-attempt row-lock lifecycle with deferred consumption - Redacted audit logging; encrypted IdP config and external identity claims by default - Independent rate limiters: `sso.redirect`, `sso.callback`, `sso.acs`, `sso.metadata` - Safe `redirect_to` validation at storage and callback time Full checklist: [Security Guide](docs/security.md). Further reading: - [Threat Model](laravel-sso-threat-model.md) — STRIDE analysis and integrator checklist - [Security Best Practices Report](security_best_practices_report.md) — remediation status and operational guidance Claims persistence ------------------ [](#claims-persistence) External identities persist minimized canonical claims by default: ``` 'claims' => [ 'persist_raw' => false, 'persist_groups' => true, 'max_group_items' => 100, 'encrypt_persisted' => true, ], ``` Auth attempt lifecycle ---------------------- [](#auth-attempt-lifecycle) Callbacks use reserve → validate → consume (or retryable failure). See [Auth Attempt Lifecycle](docs/auth-attempt-lifecycle.md). Data retention -------------- [](#data-retention) Schedule daily pruning: ``` Schedule::command('sso:prune --attempts-days=7 --audit-days=30')->daily(); ``` Testing ------- [](#testing) ``` composer test composer ci # full quality gate ``` Upgrade guidance ---------------- [](#upgrade-guidance) Review [Upgrade Guide](docs/upgrade-guide.md) and [CHANGELOG](CHANGELOG.md) before upgrading. Changelog --------- [](#changelog) See [CHANGELOG](CHANGELOG.md). Contributing ------------ [](#contributing) See [CONTRIBUTING](CONTRIBUTING.md). Security Vulnerabilities ------------------------ [](#security-vulnerabilities) See [SECURITY.md](SECURITY.md) or the GitHub security policy. Credits ------- [](#credits) - [Godspower Oduose](https://github.com/rockblings) - [All Contributors](../../contributors) License ------- [](#license) MIT — see [LICENSE.md](LICENSE.md). ### Health Score 45 — FairBetter than 91% of packages Maintenance90 Actively maintained with recent releases Popularity20 Limited adoption so far Community9 Small or concentrated contributor base Maturity52 Maturing project, gaining track record Bus Factor1 Top contributor holds 97.7% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 5 Last Release 47d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/5b5e5ba42a2029e0f2fa45bd8d874c98599af2d2a1e77bff012ea07eeb0b65bc?d=identicon)[rockblings](/maintainers/rockblings) --- Top Contributors [![rockblings](https://avatars.githubusercontent.com/u/5190259?v=4)](https://github.com/rockblings "rockblings (291 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (7 commits)") --- Tags laravelAuthenticationSSOsamlSAML2provisioningmulti-tenantOpenID Connectoidc ### Code Quality TestsPest Static AnalysisPHPStan, Rector Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/creativecrafts-laravel-sso/health.svg) ``` [![Health](https://phpackages.com/badges/creativecrafts-laravel-sso/health.svg)](https://phpackages.com/packages/creativecrafts-laravel-sso) ``` ### Alternatives [spatie/laravel-permission Permission handling for Laravel 12 and up 13.0k107.5M1.6k](/packages/spatie-laravel-permission)[psalm/plugin-laravel Psalm plugin for Laravel 3345.4M354](/packages/psalm-plugin-laravel)[spatie/laravel-health Monitor the health of a Laravel application 88212.7M189](/packages/spatie-laravel-health)[laravel/ai The official AI SDK for Laravel. 1.1k4.6M323](/packages/laravel-ai)[simplestats-io/laravel-client Server-side analytics for Laravel that follows the full funnel from visit to registration to payment, attributed to the channel that drove it. Revenue, MRR, churn and ad-spend profit (ROAS/CAC) per channel. GDPR compliant, ad-blocker proof. 5226.7k](/packages/simplestats-io-laravel-client)[masterix21/laravel-licensing Laravel licensing package with polymorphic assignment to any model, activation keys, expirations/renewals, and seat control via LicenseUsage. Supports offline verification with public-key–signed tokens, a CLI to generate/rotate/revoke keys, and an extensible architecture via config and contracts. 1614.1k4](/packages/masterix21-laravel-licensing) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)