PHPackages                             gcgov/framework-service-auth-ms-front - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. gcgov/framework-service-auth-ms-front

ActiveFramework-service[Authentication & Authorization](/categories/authentication)

gcgov/framework-service-auth-ms-front
=====================================

Plugins enables the exchange of a Microsoft access token for an application access token. The service assumes the user's front end will handle the authentication flow to acquire and manage the expiration of the Microsoft access token. When the framework app's token expires, user must re-exchange a valid Microsoft access token for an updated app access token. There are no app refresh tokens or mechanisms.

v1.2.2(2mo ago)09MITPHPPHP >=8.1CI passing

Since Aug 7Pushed 1mo ago1 watchersCompare

[ Source](https://github.com/gcgov/framework-service-auth-ms-front)[ Packagist](https://packagist.org/packages/gcgov/framework-service-auth-ms-front)[ RSS](/packages/gcgov-framework-service-auth-ms-front/feed)WikiDiscussions main Synced 2w ago

READMEChangelog (7)Dependencies (11)Versions (14)Used By (0)

Microsoft Auth Service
======================

[](#microsoft-auth-service)

Service to extend gcgov/framework
---------------------------------

[](#service-to-extend-gcgovframework)

### Primary purpose

[](#primary-purpose)

- Enable the exchange of a Microsoft access token for an application access token. The service assumes the user's front end will handle the authentication flow to acquire and manage the expiration of the Microsoft access token. When the framework app's token expires, user must re-exchange a valid Microsoft access token for an updated app access token. There are no app refresh tokens or mechanisms.

### Impact to application

[](#impact-to-application)

- Router:
    - Adds route `/.well-known/jwks.json` - provides endpoint to enable front end validation of tokens generated by the api
    - Adds route `/auth/microsoft` - exchanges a valid Microsoft authentication token for an app access
    - Adds route `/auth/fileToken` - create a short lived access token that can be used in the url for supported routes

Installation:
-------------

[](#installation)

- Require using Composer
- Add namespace `\gcgov\framework\services\authmsfront` to `\app\app->registerFrameworkServiceNamespaces()`

### Implementation

[](#implementation)

- Requests to `/auth/microsoft` must provide `Authorization` header with the valid Microsoft access token. Ex `Authorization: Bearer {microsoft_token}`
- Response body: `{ 'access_token':'-app_access_token-', 'expires_in':3600, 'token_type':'Bearer' }`

Configuration
-------------

[](#configuration)

### Allowed Users

[](#allowed-users)

By default, users attempting to sign in who not already present in the user database collection will be prevented from signing in. To enable sign in for any user who passes the third party Oauth provider authentication, set config variable `blockNewUsers=false`. When `blockNewUsers=false`, any user successfully authenticated by the third party Oauth provider will be automatically added to the database user config

```
$msAuthConfig = msAuthConfig::getInstance();
$msAuthConfig->setBlockNewUsers( false );
```

### New User Default Roles

[](#new-user-default-roles)

When `blockNewUsers=false`, new users will be automatically added to the user database collection. To set the default roles that a new user should be assigned at creation, provide the roles to the `setBlockNewUsers` method.

```
$msAuthConfig = msAuthConfig::getInstance();
$msAuthConfig->setBlockNewUsers( false, [ 'Role1.Read', 'Role2.Read', 'Role2.Write' ] );
```

###  Health Score

43

—

FairBetter than 89% of packages

Maintenance90

Actively maintained with recent releases

Popularity5

Limited adoption so far

Community9

Small or concentrated contributor base

Maturity60

Established project with proven stability

 Bus Factor1

Top contributor holds 68.8% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~129 days

Recently: every ~159 days

Total

9

Last Release

71d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/e97ad9c5583ee03e1f670eba13bd11b81e3374da1941dce10f6da80e5dc6d8eb?d=identicon)[andrewsauder](/maintainers/andrewsauder)

---

Top Contributors

[![andrewsauder](https://avatars.githubusercontent.com/u/1380472?v=4)](https://github.com/andrewsauder "andrewsauder (11 commits)")[![claude](https://avatars.githubusercontent.com/u/81847?v=4)](https://github.com/claude "claude (5 commits)")

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/gcgov-framework-service-auth-ms-front/health.svg)

```
[![Health](https://phpackages.com/badges/gcgov-framework-service-auth-ms-front/health.svg)](https://phpackages.com/packages/gcgov-framework-service-auth-ms-front)
```

###  Alternatives

[tg/tgwebvalid

An easy way to validate Telegram Login Widget and Telegram Mini App users on your website using PHP

6827.5k1](/packages/tg-tgwebvalid)[vitalybaev/laravel5-dkim

Laravel 5/6 package for signing outgoing messages with DKIM.

3163.1k](/packages/vitalybaev-laravel5-dkim)[kissdigital-com/apple-sign-in-client-secret-generator

PHP package for generating 'client secret' for Sign In with Apple

2125.5k](/packages/kissdigital-com-apple-sign-in-client-secret-generator)[denniseilander/laravel-passport-scopes-restriction

Restrict scopes for different Laravel Passport clients.

1636.3k](/packages/denniseilander-laravel-passport-scopes-restriction)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)