PHPackages                             track-any-device/sso-server - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. track-any-device/sso-server

ActiveLibrary[Authentication & Authorization](/categories/authentication)

track-any-device/sso-server
===========================

OAuth2 SSO authorization server — token issuance, migrations, and route helper.

v0.7.1(1mo ago)0480MITPHP ^8.3

Since May 23Compare

[ Source](https://github.com/track-any-device/package-sso-server)[ Packagist](https://packagist.org/packages/track-any-device/sso-server)[ RSS](/packages/track-any-device-sso-server/feed)WikiDiscussions Synced 3w ago

READMEChangelog (10)Dependencies (6)Versions (29)Used By (0)

track-any-device/sso-server
===========================

[](#track-any-devicesso-server)

OAuth 2.0 authorization-code SSO server for the Track Any Device platform.
Wraps Laravel Passport to issue short-lived authorization codes that Socialite clients exchange for access tokens, with multi-tenant access control baked in.

---

Requirements
------------

[](#requirements)

DependencyVersionPHP^8.3Laravel^13.7Laravel Passport^13.0track-any-device/core^0.0.2---

Installation
------------

[](#installation)

```
composer require track-any-device/sso-server
```

Publish the package config:

```
php artisan vendor:publish --tag=sso-server-config
```

---

Environment variables
---------------------

[](#environment-variables)

Add these to the `.env` of whichever surface runs the identity / login host:

VariableDefaultDescription`APP_SURFACE``core`Surface name. Migrations only run when this is `core`. Values: `core | login | my | admin | tenant``APP_DOMAIN``track-any-device.com`Root domain used to derive all sub-domain URLs`MY_DOMAIN``my.{APP_DOMAIN}`Hostname of the end-user "my" app`LOGIN_DOMAIN`*(current host)*Hostname of the dedicated identity / login surface. Leave unset for single-host deploys---

Migrations
----------

[](#migrations)

Migrations are loaded automatically when `APP_SURFACE=core` (or is unset). They create:

- `oauth_clients` — SSO client registry (extended Passport client table)
- `sso_tokens` — audit log of issued / consumed tokens
- Passport token tables (`oauth_auth_codes`, `oauth_access_tokens`, `oauth_refresh_tokens`, `oauth_device_codes`) with `client_id` columns widened to `varchar(100)` for `tci_*` prefixed identifiers

---

Seeding
-------

[](#seeding)

Seed the singleton clients for the `web`, `my`, `admin`, and `graphql` surfaces:

```
php artisan db:seed --class="TrackAnyDevice\SsoServer\Database\Seeders\OAuthClientSeeder"
```

On first run the plain-text secret is printed to stdout once — copy it into the relevant `client_secret` env var on the consuming surface. To rotate a secret, delete the row and re-run.

---

Route registration
------------------

[](#route-registration)

### Web routes (login surface)

[](#web-routes-login-surface)

Register inside your `login.{domain}` route group (web middleware, Fortify session):

```
// routes/web.php or routes/auth.php
use TrackAnyDevice\SsoServer\SsoServer;

Route::middleware(['web'])->group(function () {
    SsoServer::routes();
    // Registers: GET oauth/authorize → OAuthAuthorizeController (oauth.authorize)
});
```

### API routes (token-protected user info endpoint)

[](#api-routes-token-protected-user-info-endpoint)

Register inside an `auth:api` middleware group:

```
// routes/api.php
use TrackAnyDevice\SsoServer\SsoServer;

Route::middleware(['auth:api'])->group(function () {
    SsoServer::apiRoutes();
    // Registers: GET api/sso/user → SsoUserController (sso.user)
});
```

---

Host-app contracts
------------------

[](#host-app-contracts)

The host app **must** define the following named routes:

Route nameSurfaceUsed when`login`loginUnauthenticated user hits `/oauth/authorize``orders.index`my`Role::User` logs in with no OAuth intent`tenant.select`login`tenant_user` belongs to multiple tenantsThe host app **must** bind `Laravel\Fortify\Contracts\LoginResponse` to `TrackAnyDevice\SsoServer\Http\Responses\LoginResponse` in a service provider:

```
$this->app->singleton(
    \Laravel\Fortify\Contracts\LoginResponse::class,
    \TrackAnyDevice\SsoServer\Http\Responses\LoginResponse::class,
);
```

---

Auth flow
---------

[](#auth-flow)

```
Browser                  login.domain               tenant.domain
  │                           │                           │
  ├─ GET /oauth/authorize?    │                           │
  │    client_id=tci_tenant_… │                           │
  │    response_type=code     │                           │
  │    redirect_uri=…/sso/cb  │                           │
  │    state=…                │                           │
  │──────────────────────────>│                           │
  │                           ├─ Verify client active     │
  │                           ├─ Check user ∈ tenant      │
  │                           ├─ Passport issues auth code│
  ││
  │                           ││
  │                           │