PHPackages track-any-device/sso-client - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. track-any-device/sso-client ActiveLibrary[Authentication & Authorization](/categories/authentication) track-any-device/sso-client =========================== OAuth2 SSO client — token verification, callback controller, and route helper. v0.3.1(1mo ago)0478MITPHP ^8.3 Since May 23Compare [ Source](https://github.com/track-any-device/package-sso-client)[ Packagist](https://packagist.org/packages/track-any-device/sso-client)[ RSS](/packages/track-any-device-sso-client/feed)WikiDiscussions Synced 3w ago READMEChangelog (10)Dependencies (6)Versions (18)Used By (0) track-any-device/sso-client =========================== [](#track-any-devicesso-client) OAuth2 SSO client for the Track Any Device platform — Socialite driver, callback controller, and route helper that integrate with `package-sso-server` (Passport-backed central auth). --- Requirements ------------ [](#requirements) DependencyVersionPHP^8.3Laravel^13.7laravel/socialite^5.0track-any-device/core^0.0.2Stancl/Tenancy (host app)^3.x--- Installation ------------ [](#installation) ``` composer require track-any-device/sso-client ``` Laravel's package auto-discovery registers `SsoClientServiceProvider` automatically. Publish the config stub: ``` php artisan vendor:publish --tag=sso-client-config ``` --- Environment variables --------------------- [](#environment-variables) Add to the host app's `.env` (and `config/services.php`): ``` SSO_SERVER_URL=https://login.example.com # base URL of the central SSO host SSO_CLIENT_ID= # fallback for local dev (before DB is seeded) SSO_CLIENT_SECRET= # fallback for local dev SSO_REDIRECT_URI=https://tenant.example.com/sso/callback APP_SURFACE=tenant # must match the `kind` column in oauth_clients ``` Map them in `config/services.php`: ``` 'sso' => [ 'server_url' => env('SSO_SERVER_URL', ''), 'client_id' => env('SSO_CLIENT_ID', ''), 'client_secret' => env('SSO_CLIENT_SECRET', ''), 'redirect' => env('SSO_REDIRECT_URI', ''), ], ``` And surface in `config/app.php` (or a custom config file — see issue #3): ``` 'surface' => env('APP_SURFACE', ''), ``` --- Routes the host app must register --------------------------------- [](#routes-the-host-app-must-register) Call `SsoClient::routes()` inside the tenant route group so the callback is scoped correctly. The route must be **exempt** from any `AuthorizeTenantAccess`middleware that guards authenticated routes. ``` // routes/tenant.php use TrackAnyDevice\SsoClient\SsoClient; Route::middleware(['web'])->group(function () { // Exempt from auth guard — guests hit this to complete the SSO handshake. SsoClient::routes(); Route::middleware(['auth'])->group(function () { // ... authenticated tenant routes }); }); ``` Registered route: MethodURINameControllerGET`/sso/callback``tenant.sso.callback``SsoCallbackController`--- Phone verification on the authorize endpoint -------------------------------------------- [](#phone-verification-on-the-authorize-endpoint) On the login domain (where Passport is running), the service provider automatically adds `phone.verified` middleware to Passport's `/oauth/authorize` routes (GET, POST, DELETE). This prevents unverified users from obtaining authorization codes and avoids a redirect loop between app surfaces and the login domain. The `phone.verified` middleware alias must be registered by the host application (e.g. in `bootstrap/app.php`). The middleware is only applied when the Passport routes exist — on tenant apps this is a safe no-op. Phone setup routes (`phone.edit`, `phone.verify`, `phone.send`, `phone.resend`, `logout`) are excluded inside the middleware itself and remain accessible. --- Auth flow --------- [](#auth-flow) ``` Browser → GET /oauth/authorize (SSO server) ← 302 to /sso/callback?code=…&state=… (tenant app) Tenant → POST /oauth/token (SSO server — exchanges code for access token) ← { access_token, … } Tenant → GET /api/sso/user (SSO server — fetches user payload) ← { id, name, email, … } Tenant → Auth::login($user) + session()->regenerate() → redirect()->intended('/dashboard') ``` 1. The service provider registers a `sso` Socialite driver backed by `SsoProvider`. 2. On boot, it resolves OAuth2 client credentials from the `oauth_clients` table (column `kind` matches `APP_SURFACE`), falling back to `config/services.php` when the DB is unavailable (local dev). 3. `SsoCallbackController` handles the callback, logs the user in, and carries OTP freshness across the SSO boundary via the `sms_2fa_verified` session key. ### Session key written by this package [](#session-key-written-by-this-package) KeyTypeMeaning`sms_2fa_verified``bool`Set to `true` when the user's `last_otp_validated_on` is within 15 minutes. Host-app 2FA middleware must read this key to skip re-challenge.### Flash key written on failure [](#flash-key-written-on-failure) KeyValue`errors_sso`Human-readable error stringRead in Blade: `@if(session('errors_sso')) … @endif` --- Release workflow convention --------------------------- [](#release-workflow-convention) The release workflow (`.github/workflows/release.yml`) auto-tags and publishes a GitHub release on every push to `main`. It derives the version bump from conventional commit prefixes: Commit prefixBump`feat!:` / `BREAKING CHANGE`major`feat:`minor`fix:`, `chore:`, `docs:`, `refactor:`, `perf:`, `style:`, `test:`, `ci:`patchManual dispatch lets you override the bump type (patch / minor / major) regardless of commit messages. No `version` field is kept in `composer.json`; Packagist reads the git tag. ### Health Score 43 — FairBetter than 89% of packages Maintenance93 Actively maintained with recent releases Popularity18 Limited adoption so far Community2 Small or concentrated contributor base Maturity47 Maturing project, gaining track record How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~2 days Total 12 Last Release 35d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/83275f3144d4cc4092e54dd8d5acf6a048536f6d7e454d741ae82a61f904c737?d=identicon)[ahmadkokab](/maintainers/ahmadkokab) ### Embed Badge ![Health badge](/badges/track-any-device-sso-client/health.svg) ``` [![Health](https://phpackages.com/badges/track-any-device-sso-client/health.svg)](https://phpackages.com/packages/track-any-device-sso-client) ``` ### Alternatives [leantime/leantime Open source project management system for non-project managers. Simple like Trello, powerful like Jira. Built with neurodiversity in mind. 10.2k4.0k](/packages/leantime-leantime)[unopim/unopim UnoPim Laravel PIM 10.5k2.4k](/packages/unopim-unopim)[nasirkhan/laravel-starter A CMS like modular Laravel starter project. 1.4k2.7k](/packages/nasirkhan-laravel-starter)[duncanmcclean/statamic-cargo Comprehensive e-commerce addon for Statamic. Build bespoke e-commerce sites without the complexity. 3518.3k](/packages/duncanmcclean-statamic-cargo) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)