PHPackages                             voltcms/useraccess - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. voltcms/useraccess

ActiveProject[Authentication & Authorization](/categories/authentication)

voltcms/useraccess
==================

UserAccess

2.0.1(3w ago)029ISCPHPPHP >=8.2CI passing

Since Mar 9Pushed 3w ago1 watchersCompare

[ Source](https://github.com/voltcms/useraccess)[ Packagist](https://packagist.org/packages/voltcms/useraccess)[ RSS](/packages/voltcms-useraccess/feed)WikiDiscussions master Synced 2w ago

READMEChangelog (2)Dependencies (9)Versions (26)Used By (0)

VoltCMS UserAccess
==================

[](#voltcms-useraccess)

[![CI](https://github.com/voltcms/useraccess/actions/workflows/ci.yml/badge.svg)](https://github.com/voltcms/useraccess/actions/workflows/ci.yml)

A small, dependency‑light **PHP 8 library for user and access management**. It stores users and groups in a flat‑file JSON database and exposes them through a **SCIM 2.0**(RFC 7643/7644) REST API, plus session, HTTP Basic, and OAuth Bearer authentication helpers for protecting pages and provisioning from an identity provider (Okta, Entra ID, …).

It is published as a Composer package (PSR‑4 namespace `VoltCMS\UserAccess\` → `src/`) and is meant to be **embedded in a host application**, not run standalone. The `demo/` directory shows a complete, fully‑authenticated integration.

> Working in this repo with an AI assistant? Read [`CLAUDE.md`](CLAUDE.md) for the deep architecture/conventions guide, and the [For AI agents](#for-ai-agents-integrating-into-another-project)section below for a copy‑pasteable integration recipe.

---

Table of contents
-----------------

[](#table-of-contents)

- [Features](#features)
- [Requirements](#requirements)
- [Installation](#installation)
- [Quick start](#quick-start)
- [Architecture](#architecture)
- [The SCIM API](#the-scim-api)
- [Custom user attributes](#custom-user-attributes)
- [Authentication](#authentication)
- [Security & hardening](#security--hardening)
- [Configuration reference](#configuration-reference)
- [The demo](#the-demo)
- [Testing & CI](#testing--ci)
- [Deploying to production](#deploying-to-production)
- [For AI agents](#for-ai-agents-integrating-into-another-project)
- [Not yet implemented](#not-yet-implemented)
- [License](#license)

---

Features
--------

[](#features)

- **SCIM 2.0 REST API** for Users and Groups: GET (list + single), POST, PUT, PATCH, DELETE, plus discovery (`/ServiceProviderConfig`, `/ResourceTypes`, `/Schemas`) and `/Me`. Responses use `application/scim+json`.
- **Three authentication modes**, usable together:
    - PHP **session** login (CSRF‑protected, session‑fixation hardened);
    - HTTP **Basic**;
    - OAuth **Bearer** token (for IdP provisioning).
- **Secure by default** — the SCIM router requires an authenticated administrator unless you explicitly opt out.
- **Security hardening built in**: bcrypt password hashing with an 8–72 char policy, shared‑storage brute‑force lockout, optional HTTPS enforcement + HSTS, proxy‑aware HTTPS detection, data‑directory web‑access protection, and an append‑only **audit log** of admin actions.
- **Custom user attributes** — store host‑defined fields on a user; they are exposed over SCIM through a schema extension.
- **No SQL** — a flat‑file JSON store (`voltcms/filedb`) with a process‑wide write mutex.
- Small, framework‑light, easy to read and audit.

Requirements
------------

[](#requirements)

- **PHP ≥ 8.2** (developed against 8.4).
- **Composer 2**.
- A web server that routes unknown paths to a front controller and passes the `Authorization`header through (Apache rewrite provided in `demo/api/.htaccess`; nginx `try_files` works too).

Installation
------------

[](#installation)

This package is distributed via its Git repository. Add it to your project's `composer.json`:

```
{
    "repositories": [
        { "type": "vcs", "url": "https://github.com/voltcms/useraccess" }
    ],
    "require": {
        "voltcms/useraccess": "^2.0"
    }
}
```

```
composer update voltcms/useraccess
```

Or, working inside this repository directly:

```
composer install      # install dependencies into vendor/
composer test         # run the PHPUnit suite
```

Quick start
-----------

[](#quick-start)

A minimal, **production‑oriented** front controller. Point your web server so every request under `/scim/...` reaches this file.

```