Download the PHP package cboxdk/laravel-id without Composer

On this page you can find all versions of the php package cboxdk/laravel-id. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of cboxdk/laravel-id

Informations about the package laravel-id

Cbox ID

cboxdk/laravel-id is a Laravel-native auth and identity framework. Central login, enterprise SSO, directory sync, RBAC, billing-driven entitlements and a tamper-evident audit trail: all interface-driven, deny-by-default, and verified (tests + PHPStan level max + composer audit) before it ships.

UI-free and domain-free: every capability sits behind a contract you bind, mock, extend or replace.

Install

A taste

Environments first. Organization, User and the other domain models are environment-owned and deny-by-default — the calls above need an environment in context (a request resolves one from its host, or set cbox-id.environments.default; the deployable app creates the first one from its installer, and the rest from its platform console). See Environments & the isolation model.

What's supported

Grades are against this package's own src/ — never the deployable app or an add-on. Full = ships and is tested · Partial = works, with the named limit · Contract only = you bind the implementation · Host = your app writes the interactive half · No = not implemented. Every row is expanded, with its caveats, in Standards & conformance and Feature support.

Area Support
OAuth 2.0 Full authorization-code + PKCE S256 (RFC 7636), client-credentials, refresh with rotation + reuse detection, RFC 8414 / 9728 metadata · Partial introspection (RFC 7662), revocation (RFC 7009), device grant (RFC 8628), PAR (RFC 9126), DPoP (RFC 9449), token exchange (RFC 8693), resource indicators (RFC 8707), DCR (RFC 7591/7592), step-up challenge (RFC 9470: acr/auth_time on access tokens and introspection, insufficient_user_authentication builder) · No ROPC, implicit, mTLS (RFC 8705), JAR (RFC 9101), JARM
OpenID Connect Full discovery, JWKS, UserInfo, RP-Initiated Logout, Back-Channel Logout · Partial id_token (code flow + query mode only), CIBA (poll only) · Host /authorize, consent, prompt/max_age/acr_values gating (the package ships the AuthenticationRequirement check your /authorize calls), RFC 9207 iss · No front-channel logout, pairwise sub
SAML 2.0 (IdP role) Full signed assertions and responses, RSA-SHA256, HTTP-Redirect + HTTP-POST, signed-AuthnRequest verification, XSW-hardened, SP-initiated SLO · No HTTP-Artifact, outbound assertion encryption, unsolicited SSO, global logout fan-out
SAML 2.0 / OIDC (relying party) Full ACS with replay protection, JIT provisioning, JWKS rotation, state/nonce, a catalogue of 15 sign-in providers (incl. LinkedIn, Bitbucket, Xero, Intuit), setup guides for 20 enterprise IdPs · Partial SLO (receive-only), inbound assertion decryption · No signed outbound AuthnRequest, PKCE on the outbound OIDC leg
SCIM 2.0 Full Users + Groups CRUD, Enterprise User extension (RFC 7643), the full RFC 7644 filter grammar, sorting, ETags (If-Match / If-None-Match), /Bulk with bulkId references, errors and discovery; held to Microsoft Entra ID's and Okta's published test cases · Partial PATCH (value-path filters; one stored email), attribute selection · No /.search, /Me
Provisioning out Partial generic SCIM 2.0 client with outbox, retries, circuit breaker, SSRF guard — users only, no group push, no vendor connectors
Directory in Full SCIM push, Google Workspace and Microsoft Entra pull; deprovision revokes sessions immediately
MFA & credentials Full recovery codes, magic links, password reset, password policy (length/reuse/expiry/lockout) · Partial TOTP (RFC 6238, SHA-1/6/30 fixed), WebAuthn/passkeys (ES256+RS256, none + self-attested packed), email OTP, SMS OTP (Twilio, MessageBird, Bird, 46elks over HTTP; toll-fraud guard) and an SMS second factor (off by default per environment) · Contract only breach screening · No HOTP (RFC 4226), complexity classes
Authorization Full org-scoped RBAC with hierarchy roll-down, entitlements, POST /oauth/decisions · Partial ReBAC engine (uncached), the PDP (ReBAC-only) · No wildcard permissions, role-inherits-role, XACML
Audit Full SHA-256 hash chain, query + pull stream, retention · Partial signed checkpoints (nothing schedules them), SIEM streaming (HTTP transport only: Splunk HEC / ECS / GELF / CEF / JSON) · No tamper-proof storage, OCSF
Governance Full access-certification campaigns · Partial Segregation of Duties — both cover roles and memberships only
Crypto Full XChaCha20-Poly1305 AEAD at rest, signing-key rotation with overlap, closed RS256/ES256/EdDSA allow-list (RFC 8725, RFC 8037), JWKS (RFC 7517), at+jwt (RFC 9068) · Contract only HSM/KMS · No JWE (RFC 7516), master-key rotation
Delivery Full transactional outbox, webhooks (HMAC-SHA256, retries, circuit breaker; per endpoint either the Cbox signature or Standard Webhooks, with receiver-side verifiers for both), six inline hook points · Partial at-least-once only; no secret-rotation overlap window

This package does not serve /authorize. It ships the back-channel — token, introspection, revocation, registration, PAR, device, CIBA, discovery, JWKS — and the crypto and validation behind them. Login, consent, and everything decided at the authorization request are your app's, and are marked Host above. The deployable cbox-id app implements that half if you would rather not.

Modules

Layer Modules
Kernels Tenancy · Crypto · Audit · Events · Authorization · Usage
Domain Organization · Identity · Otp · AccessControl · Directory (inbound SCIM + pull connectors) · Provisioning (outbound SCIM) · Federation (SSO relying party) · SamlIdp (SAML 2.0 IdP) · OAuthServer (OAuth 2.0 / OIDC) · Governance (access reviews, SoD) · TokenVault · FeatureFlags · Pipes (connected third-party accounts) · ExternalActions (inline hooks) · Webhooks · AuditQuery · AuditStreaming
HTTP & ops Api (OAuth/OIDC/SCIM/SAML endpoints) · Platform (operators + the self-serve account/project plane) · Maintenance (retention) · Console (17 cbox-id:* commands)

Documentation

Full docs live in docs/:

License

MIT. Published on Packagist as a 1.x release under semantic versioning — installable via composer require cboxdk/laravel-id. Breaking changes wait for a major; every one that has happened is written up in UPGRADING.md.

All versions of laravel-id with dependencies

PHP Build Version
Package Version
Requires php Version ^8.4
ext-openssl Version *
ext-sodium Version *
cboxdk/laravel-audit-chain Version ^0.1
cboxdk/laravel-siem Version ^0.1 || ^0.2
cboxdk/laravel-ssrf Version ^1.1.1
cboxdk/siem Version ^0.1
firebase/php-jwt Version ^7.0
illuminate/auth Version ^12.0 || ^13.0
illuminate/contracts Version ^12.0 || ^13.0
illuminate/database Version ^12.0 || ^13.0
illuminate/support Version ^12.0 || ^13.0
onelogin/php-saml Version ^4.0
robrichards/xmlseclibs Version ^3.1.5 || ^4.0.0
spomky-labs/cbor-php Version ^3.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package cboxdk/laravel-id contains the following files

Loading the files please wait ...