PHPackages padosoft/laravel-iam-server - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. padosoft/laravel-iam-server ActiveLibrary[Authentication & Authorization](/categories/authentication) padosoft/laravel-iam-server =========================== Server Laravel IAM: identity, organizations, Application Registry + manifest, PDP (RBAC+ABAC+ReBAC), OAuth (league/oauth2-server) + OIDC layer, audit tamper-evident, governance/IGA, Admin API + panel. v1.22.0(2w ago)13854MITPHPPHP ^8.3CI failing Since Jun 27Pushed 2w ago1 watchersCompare [ Source](https://github.com/padosoft/laravel-iam-server)[ Packagist](https://packagist.org/packages/padosoft/laravel-iam-server)[ RSS](/packages/padosoft-laravel-iam-server/feed)WikiDiscussions main Synced 2w ago READMEChangelog (10)Dependencies (17)Versions (27)Used By (4) [![Laravel IAM](art/banner.png)](art/banner.png) Laravel IAM β€” Server ==================== [](#laravel-iam--server) **A self-hostable Identity & Authorization control plane for Laravel.** An OAuth2 / OIDC identity provider, a RBAC + ABAC + ReBAC policy decision point, tamper-evident audit, IGA governance and an admin panel β€” in one composer package you own. [![Tests](https://camo.githubusercontent.com/26101d536961fd93af87d5ce72baee7a578f5a43376bae39db26e75ef4771b73/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f7061646f736f66742f6c61726176656c2d69616d2d7365727665722f74657374732e796d6c3f6272616e63683d6d61696e267374796c653d666c61742d737175617265266c6162656c3d7465737473)](https://github.com/padosoft/laravel-iam-server/actions/workflows/tests.yml) [![Latest Version on Packagist](https://camo.githubusercontent.com/032311375c9822f50e78059cf7f7f9cf7ce4628351740bd63fc4f1c6d308e8bb/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f7061646f736f66742f6c61726176656c2d69616d2d7365727665722e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/padosoft/laravel-iam-server) [![Total Downloads](https://camo.githubusercontent.com/50b73319ad374ed7478f4239add9c30cc5a39b12ee12da88e4d51f425cf91766/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f7061646f736f66742f6c61726176656c2d69616d2d7365727665722e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/padosoft/laravel-iam-server) [![PHP Version](https://camo.githubusercontent.com/89e9aacf0c79a183ed0da30695d3dc361a8c829f1589e872b6789498debf3dc1/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f7061646f736f66742f6c61726176656c2d69616d2d7365727665722e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/padosoft/laravel-iam-server) [![License](https://camo.githubusercontent.com/942e017bf0672002dd32a857c95d66f28c5900ab541838c6c664442516309c8a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e7376673f7374796c653d666c61742d737175617265)](LICENSE) **[πŸ“– Read the documentation β†’](https://doc.laravel-iam-server.padosoft.com)** Guides Β· concepts Β· architecture Β· Admin API & PHP reference --- Why this package ---------------- [](#why-this-package) Most teams end up with authorization scattered across every app: a `spatie/permission` table here, a pile of `Gate::define()` closures there, hand-rolled OAuth somewhere else, and no idea who can do what or who decided it. Renting an IdP (Auth0, Okta, Entra) fixes login but leaves *authorization* β€” and your audit trail β€” off in someone else's cloud, metered per MAU. **`laravel-iam-server` is the control plane you host yourself.** It is at once: - an **identity provider** β€” OAuth2 (`league/oauth2-server`) + an OIDC layer, with sessions you can revoke; - a **policy decision point (PDP)** β€” one deterministic engine that answers *"can subject X do permission Y on resource Z?"* with **RBAC + ABAC + ReBAC**, **deny-overrides**, **fail-closed**, and a citable explanation; - a **tamper-evident audit log** β€” every mutation hash-chained and verifiable, exportable to your SIEM; - an **identity governance (IGA)** suite β€” access reviews, access requests/approvals, least-privilege recommendations, SoD; - an **admin panel** β€” a React console driven entirely through the Admin API (no UI ever touches the DB). Apps stop owning authorization logic. They **declare** their permissions/roles/scopes in a *manifest*, and ask the PDP. You get one place to see and prove every access decision. Features -------- [](#features) - **Deterministic PDP** β€” `NativeSqlEngine` evaluates RBAC + ABAC (attribute conditions) + ReBAC (relationship lookups: `listSubjects` / `listResources`) in one pass, deny-overrides, fail-closed. Every `Decision` carries a `decision_id`, the matched policies and a human-readable `explanation` you can cite in audit. - **Application Registry + manifests** β€” apps submit a manifest of their permissions/roles/scopes/conditions; it is **validated, diffed, approved, applied and rollback-able**. The core hardcodes nothing. - **Full OAuth2 + OIDC IdP** β€” authorization-code/PKCE, client-credentials, refresh (encrypted), JWKS, an OIDC layer on an **MIT** base (never AGPL). Bring your own login backend (Fortify, Socialite, passkeys). - **Application credential lifecycle** β€” IAM issues the `client_secret` at manifest apply (one-time, hashed), with **zero-downtime rotation** (grace window), **scheduled expiry + alerts**, opt-in **auto-rotation** with app **self-fetch**, and revocation. Full guide: [Application credentials & lifecycle](https://doc.laravel-iam-server.padosoft.com/guides/application-credentials). - **`private_key_jwt` β€” asymmetric client auth, NO shared secret** (RFC 7523 / OIDC Β§9). A client registers only its **public** key (JWKS) and proves itself by signing a short-lived, audience-bound, single-use (`jti`) ES256 assertion β€” nothing secret ever leaves the client, nothing to rotate or leak. Full guide: [private\_key\_jwt](https://doc.laravel-iam-server.padosoft.com/guides/private-key-jwt). - **Tamper-evident audit** β€” hash-chained events (`AuditChainAppender` / `AuditChainVerifier`), SIEM export, webhooks/outbox, and GDPR crypto-shredding / legal-hold for PII. - **Identity governance (IGA)** β€” access-review campaigns, access-request approval flows, least-privilege recommendations, separation-of-duties, anomaly signals β€” each gated per layer/app/role/user via a feature scope. - **Assurance / step-up** β€” NIST 800-63B assurance levels; the PDP can require step-up (AAL2) for critical actions. - **Admin API + panel** β€” every admin route is documented in `resources/openapi.yaml` (enforced by a test), protected by the `iam.can` permission middleware, with idempotency keys on writes. The surface is complete: groups (with native ReBAC nesting), federated providers, directory sources, policy wizard, webhooks (with DLQ replay), metrics, and multi-step approver chains for access requests. - **Observability** β€” health/readiness endpoints and a pluggable tracer (`NullTracer` / `LogTracer`). Use cases --------- [](#use-cases) - **Be your organization's IdP.** Run OAuth2/OIDC login for all your apps, on infrastructure you control. - **Centralize authorization.** Many apps, one PDP: each asks `check()` instead of re-implementing roles. - **Pass an audit.** Hash-chained, verifiable history + access reviews and SoD give you the evidence compliance asks for. - **Escape scattered gates.** Migrate apps off ad-hoc `Gate`/`spatie` permissions onto declared manifests (see the [migration bridge](https://github.com/padosoft/laravel-iam-bridge-spatie-permission)). Web Admin Panel --------------- [](#web-admin-panel) A React + Vite + Tailwind console, driven **only** through the Admin API. [![Dashboard (dark)](art/screenshots/laravel-iam-webadmin-Dashboard-Dark.png)](art/screenshots/laravel-iam-webadmin-Dashboard-Dark.png) *Dashboard β€” posture at a glance.* Applications & manifestsAudit trail[![Applications](art/screenshots/laravel-iam-webadmin-Applications.png)](art/screenshots/laravel-iam-webadmin-Applications.png)[![Audit](art/screenshots/laravel-iam-webadmin-Audit.png)](art/screenshots/laravel-iam-webadmin-Audit.png)Roles & permissionsAccess reviews[![Roles and permissions](art/screenshots/laravel-iam-webadmin-Roles-and-Permissions.png)](art/screenshots/laravel-iam-webadmin-Roles-and-Permissions.png)[![Access reviews](art/screenshots/laravel-iam-webadmin-Access-reviews.png)](art/screenshots/laravel-iam-webadmin-Access-reviews.png)Policy playgroundAnomalies[![Policy playground](art/screenshots/laravel-iam-webadmin-Policy-Playground.png)](art/screenshots/laravel-iam-webadmin-Policy-Playground.png)[![Anomalies](art/screenshots/laravel-iam-webadmin-Anomalies.png)](art/screenshots/laravel-iam-webadmin-Anomalies.png)> The full set of screens (users, sessions & tokens, organizations, events & webhooks, settings…) lives in [`art/screenshots/`](art/screenshots/). Installation ------------ [](#installation) ``` composer require padosoft/laravel-iam-server ``` **Requirements:** PHP **8.3+**, Laravel **13**. A database (MySQL/PostgreSQL/SQLite). Publish config and run migrations: ``` php artisan vendor:publish --tag="laravel-iam-server-config" php artisan migrate ``` The service provider auto-registers the Admin API, OAuth and OIDC routes, and the `iam.can` / `iam.admin_auth` / `iam.idempotency` middleware. Quick start ----------- [](#quick-start) ### 1. Register an application and its manifest [](#1-register-an-application-and-its-manifest) Each consuming app declares what it needs. A manifest lists permissions/roles (slugs are immutable `app_key:permission`): ``` { "app_key": "warehouse", "permissions": [ { "key": "warehouse:stock.read", "label": "Read stock" }, { "key": "warehouse:stock.adjust", "label": "Adjust stock", "condition": { "attr": "amount", "op": "