PHPackages                             waaseyaa/oidc - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. waaseyaa/oidc

ActiveLibrary[Authentication & Authorization](/categories/authentication)

waaseyaa/oidc
=============

OpenID Connect issuer for Waaseyaa — ecosystem-wide single sign-on

v0.1.0-alpha.259(2w ago)02.2k↑38.9%4GPL-2.0-or-laterPHPPHP >=8.5

Since Apr 27Pushed 1w agoCompare

[ Source](https://github.com/waaseyaa/oidc)[ Packagist](https://packagist.org/packages/waaseyaa/oidc)[ RSS](/packages/waaseyaa-oidc/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependencies (60)Versions (97)Used By (4)

waaseyaa/oidc
=============

[](#waaseyaaoidc)

OpenID Connect issuer for the Waaseyaa ecosystem.

This package provides the authorization-server primitives used by a dedicated IdP app to act as the single sign-on provider for every Waaseyaa app (Giiken, Minoo, OIATC, NorthOps, etc.). Consumer apps do **not** install this package — they federate to the IdP via [`waaseyaa/oauth-provider`](../oauth-provider/)'s `GenericOidcProvider`.

Scope
-----

[](#scope)

- Authorization endpoint (`/authorize`)
- Token endpoint (`/token`)
- UserInfo endpoint (`/userinfo`)
- Discovery (`/.well-known/openid-configuration`)
- JWKS (`/.well-known/jwks.json`)
- Revocation (`/revoke`)
- RP-initiated logout (`/end_session`)
- Signing-key storage + rotation

Non-goals (v1)
--------------

[](#non-goals-v1)

- Multi-tenant realms
- Dynamic client registration (RFC 7591)
- SCIM provisioning
- Federation chaining

Security: secrets at rest
-------------------------

[](#security-secrets-at-rest)

OIDC secret persistence is rooted in `WAASEYAA_APP_SECRET` through distinct, versioned HKDF-SHA-256 purposes:

- RSA private keys use sodium secretbox with a fresh nonce and a strict `secretbox.hkdf-v1:` envelope. Public-key material remains directly readable.
- Opaque access and refresh tokens use separate secretbox encryption keys and separate HMAC-SHA-256 lookup keys. Exact lookup uses the keyed lookup column; the bearer value is returned only after its encrypted envelope authenticates.
- Issuer signing uses the encrypted database repository unless file keys are explicitly configured. Database key configuration or decryption errors are propagated and do not select another provider.

Existing installations run `bin/waaseyaa oidc:migrate-secrets --confirm` in maintenance mode after taking a trusted backup. The command converts signing keys, access tokens, and refresh tokens in one transaction. Runtime readers accept only authenticated envelopes; there is no ongoing plaintext read mode. See `docs/upgrade-notes/oidc-secrets-at-rest.md` for the bounded procedure.

See [ADR-006](../../docs/adr/006-cross-app-identity-via-oidc.md) for full context.

Status
------

[](#status)

**Scaffold only.** Implementation lands in follow-up PRs, TDD order per ADR-006 §7: discovery → JWKS → authorization code flow → token → userinfo → revocation → logout.

Stack
-----

[](#stack)

- [`league/oauth2-server`](https://oauth2.thephpleague.com/) — OAuth 2.0 authorization server
- [`lcobucci/jwt`](https://github.com/lcobucci/jwt) — ID token JWT assembly

License
-------

[](#license)

GPL-2.0-or-later.

###  Health Score

49

—

FairBetter than 94% of packages

Maintenance97

Actively maintained with recent releases

Popularity22

Limited adoption so far

Community16

Small or concentrated contributor base

Maturity53

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 64.9% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~1 days

Total

96

Last Release

14d ago

PHP version history (2 changes)v0.1.0-alpha.164PHP >=8.4

v0.1.0-alpha.176PHP >=8.5

### Community

Maintainers

![](https://www.gravatar.com/avatar/25d0ff572e93e3461e5180a920725d65691fd1e15e2d914b254dbbc2d6c393bd?d=identicon)[jonesrussell](/maintainers/jonesrussell)

---

Top Contributors

[![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)](https://github.com/github-actions[bot] "github-actions[bot] (85 commits)")[![jonesrussell](https://avatars.githubusercontent.com/u/499552?v=4)](https://github.com/jonesrussell "jonesrussell (46 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/waaseyaa-oidc/health.svg)

```
[![Health](https://phpackages.com/badges/waaseyaa-oidc/health.svg)](https://phpackages.com/packages/waaseyaa-oidc)
```

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)