PHPackages                             oihana/php-auth - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. oihana/php-auth

ActiveLibrary[Authentication & Authorization](/categories/authentication)

oihana/php-auth
===============

Composable PHP authorization toolkit — Casbin RBAC enforcer, JWT/OIDC verification (JWKS), fine-grained capabilities, validation rules and ready-to-use HTTP middlewares for API protection.

0.3.0(1mo ago)0504↓47.9%2MPL-2.0PHPPHP >=8.4CI passing

Since May 31Pushed 1mo agoCompare

[ Source](https://github.com/BcommeBois/oihana-php-auth)[ Packagist](https://packagist.org/packages/oihana/php-auth)[ Docs](https://github.com/BcommeBois/oihana-php-auth)[ RSS](/packages/oihana-php-auth/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependencies (34)Versions (4)Used By (2)

Oihana PHP Auth
===============

[](#oihana-php-auth)

[![Oihana PHP Auth](https://raw.githubusercontent.com/BcommeBois/oihana-php-auth/main/assets/images/oihana-php-auth-logo-inline-512x160.png)](https://raw.githubusercontent.com/BcommeBois/oihana-php-auth/main/assets/images/oihana-php-auth-logo-inline-512x160.png)

Composable PHP authorization toolkit. Part of the **Oihana PHP** ecosystem, this package combines Casbin RBAC, JWT/OIDC verification, fine-grained capabilities and HTTP middlewares to protect your APIs end‑to‑end.

[![Latest Version](https://camo.githubusercontent.com/ba282faeba8e7002f7f294cd057701a0d84ef06362747d9438e00e8fea892bdb/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6f6968616e612f7068702d617574682e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/oihana/php-auth)[![Total Downloads](https://camo.githubusercontent.com/f65b1ec66b09db1d267e4ae6e55611a919ed23cd496ab4c4726538cf650bb73a/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6f6968616e612f7068702d617574682e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/oihana/php-auth)[![License](https://camo.githubusercontent.com/50fa5f0e00d6fc049234e3d283fb8222310699a30fee0c07f5ce8b0fe94ab15e/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f6f6968616e612f7068702d617574682e7376673f7374796c653d666c61742d737175617265)](LICENSE)

📚 Documentation
---------------

[](#-documentation)

Full API reference (generated with phpDocumentor): `https://bcommebois.github.io/oihana-php-auth`

User guides (FR + EN) live under [`wiki/`](wiki/).

📦 Installation
--------------

[](#-installation)

Requires [PHP 8.4+](https://php.net/releases/). Install via [Composer](https://getcomposer.org/):

```
composer require oihana/php-auth
```

✨ What you can do
-----------------

[](#-what-you-can-do)

- **Authenticate** any request against a Zitadel / Auth0 / Keycloak IdP using a JWKS‑backed JWT validator (cached via Memcached).
- **Authorize** with [Casbin](https://casbin.org/) RBAC + domains: route‑level guards, role/permission/policy CRUD, multi‑tenant.
- **Restrict** sensitive query parameters, filter keys or skin variants with **fine‑grained capabilities** (subject `PARAM:…`).
- **Validate** request bodies via [Somnambulist Validation](https://github.com/somnambulistphp/validation) rule catalogues.
- **Reuse ready‑made HTTP middlewares** (JWT check, authorization, rate‑limit hooks) compatible with any PSR‑15 stack.

### Under the hood

[](#under-the-hood)

- A consistent set of interfaces (`CapabilityEnforcerInterface`, `PermissionSubjectResolverInterface`) you can implement against your own persistence layer.
- Pure‑PHP JWT validator built on top of [firebase/php-jwt](https://github.com/firebase/php-jwt) v7.
- Helpers for [PSR‑11 Container](https://www.php-fig.org/psr/psr-11/) wiring.
- Strongly‑typed enums and constants — no magic strings.

✅ Running tests
---------------

[](#-running-tests)

Run all tests:

```
composer test
```

Run a specific test file:

```
composer test ./tests/oihana/auth/SomeTest.php
```

🛠️ Generate the documentation
-----------------------------

[](#️-generate-the-documentation)

We use [phpDocumentor](https://phpdoc.org/) to generate documentation into the `./docs` folder.

```
composer doc
```

🧾 License
---------

[](#-license)

Licensed under the [Mozilla Public License 2.0 (MPL‑2.0)](https://www.mozilla.org/en-US/MPL/2.0/).

👤 About the author
------------------

[](#-about-the-author)

- Author: Marc ALCARAZ (aka eKameleon)
- Email: `marc@ooop.fr`
- Website: `https://www.ooop.fr`

🔗 Related packages
------------------

[](#-related-packages)

- `oihana/php-core` – core helpers and utilities: `https://github.com/BcommeBois/oihana-php-core`
- `oihana/php-enums` – typed constants & enums: `https://github.com/BcommeBois/oihana-php-enums`
- `oihana/php-exceptions` – framework exceptions: `https://github.com/BcommeBois/oihana-php-exceptions`
- `oihana/php-reflect` – reflection and hydration utilities: `https://github.com/BcommeBois/oihana-php-reflect`
- `oihana/php-schema` – Schema.org constants and vocabulary: `https://github.com/BcommeBois/oihana-php-schema`
- `oihana/php-system` – framework helpers (controllers, models, request handling): `https://github.com/BcommeBois/oihana-php-system`

###  Health Score

43

—

FairBetter than 89% of packages

Maintenance93

Actively maintained with recent releases

Popularity18

Limited adoption so far

Community10

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~10 days

Total

3

Last Release

33d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/d234506e51778dd3d1d61b6c2af6f294ff963651b4aa509b595d3d2a77b7d89b?d=identicon)[ooop](/maintainers/ooop)

---

Top Contributors

[![ekameleon](https://avatars.githubusercontent.com/u/749032?v=4)](https://github.com/ekameleon "ekameleon (20 commits)")

---

Tags

api-securityauthauthenticationauthorizationcapabilitiescasbinjwksjwtmiddlewareoauth2oidcphpphp8rbacphpjwtmiddlewareauthAuthenticationoauth2authorizationrbaccapabilitiesoidcJWKScasbinapi-security

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/oihana-php-auth/health.svg)

```
[![Health](https://phpackages.com/badges/oihana-php-auth/health.svg)](https://phpackages.com/packages/oihana-php-auth)
```

###  Alternatives

[google/auth

Google Auth Library for PHP

1.4k294.2M224](/packages/google-auth)[tempest/framework

The PHP framework that gets out of your way.

2.2k34.4k16](/packages/tempest-framework)[symfony/symfony

The Symfony PHP framework

31.4k87.2M2.2k](/packages/symfony-symfony)[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)[civicrm/civicrm-core

Open source constituent relationship management for non-profits, NGOs and advocacy organizations.

751291.4k46](/packages/civicrm-civicrm-core)[ellaisys/aws-cognito

Laravel Authentication using AWS Cognito (Web and API)

121256.9k1](/packages/ellaisys-aws-cognito)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)