Download the PHP package creativecrafts/laravel-sso without Composer
On this page you can find all versions of the php package creativecrafts/laravel-sso. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download creativecrafts/laravel-sso
More information about creativecrafts/laravel-sso
Files in creativecrafts/laravel-sso
Package laravel-sso
Short Description Multi-tenant SSO package for Laravel supporting OIDC and SAML 2.0 with provisioning, multiple guards, and optional Inertia admin UI.
License MIT
Homepage https://github.com/creativecrafts/laravel-sso
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-sso
Multi-tenant SSO (OIDC + SAML 2.0) for Laravel
Generic OIDC and SAML 2.0 SSO for Laravel, with multi-tenant support, user provisioning, identity linking, redacted audit logging, replay prevention, and configurable throttling on public SSO endpoints.
Compatibility
This package supports the runtime constraints declared in composer.json:
- PHP
^8.3(8.3, 8.4, 8.5) - Laravel / Illuminate
^12.0|^13.0
CI validates PHP 8.3–8.5 across Laravel 12 and 13. See composer.json for authoritative constraints.
Documentation
| Guide | Description |
|---|---|
| Getting Started | Install → first OIDC login |
| Configuration Reference | All config keys, env vars, IdP JSON shapes |
| Integration Guide | Policies, events, tenancy, guards, extension |
| Admin API | JSON admin API + UI scaffold |
| Operator Guide | Production operating model |
| Deployment Guide | Staging/production checklist |
| Security Guide | Hardening and operational security |
| Troubleshooting Guide | Common issues |
| Error Catalog | Exceptions and HTTP status mapping |
| Upgrade Guide | Migration and rollout notes |
| Auth Attempt Lifecycle | Callback state machine |
| Database Schema | Tables, columns, indexes, relationships |
| Architecture Audit | Design boundaries and limitations |
| Maintainer Release Checklist | Release gates |
| Contributor Matrix Testing | Local PHP/Laravel matrix |
Installation
sso:install publishes config (sso-config), migrations (sso-migrations), and optional UI assets (sso-ui).
Manual publish:
Database foundation
Published migrations create:
- tenants
- identity providers
- connections
- auth attempts
- external identities
- audit logs
Do not treat the database layer as optional.
Quick start
Configure IdP credentials (admin API or tinker), then add a login button using connection ULID:
Full walkthrough: Getting Started.
Public SSO routes
Optional: ?redirect_to=/dashboard on the redirect route (validated for safety).
Helper: sso_redirect_url($tenantUlid, $connectionUlid, $redirectTo = null).
Provisioning and identity linking
Provisioning and identity linking are deny-by-default. A successful callback creates or links a local user only when:
- the host binds custom
ProvisioningPolicy/IdentityLinkPolicyimplementations, or - package-wide defaults are enabled in
config/sso.php, or - the connection opts in via
sso_connections.settings
Connection settings override package defaults:
Claim-aware example policies: GroupRequiredProvisioningPolicy, GroupRequiredIdentityLinkPolicy. See Integration Guide.
Admin API and UI scaffold
The JSON admin API manages tenants, identity providers, and connections. Enable with SSO_UI_ENABLED=true and register a manageSso gate.
An optional Inertia UI scaffold can be published (sso-ui tag); full CRUD screens are host-app responsibility.
Details: Admin API.
Security highlights
- IdP URL trust policy (HTTPS, no private hosts by default, DNS-checked outbound calls)
- OIDC: PKCE S256, nonce, RS256 JWKS validation, encrypted PKCE verifiers
- SAML: strict XML shapes, signature validation, optional AuthnRequest signing (fail-closed)
- Auth-attempt row-lock lifecycle with deferred consumption
- Redacted audit logging; encrypted IdP config and external identity claims by default
- Independent rate limiters:
sso.redirect,sso.callback,sso.acs,sso.metadata - Safe
redirect_tovalidation at storage and callback time
Full checklist: Security Guide.
Further reading:
- Threat Model — STRIDE analysis and integrator checklist
- Security Best Practices Report — remediation status and operational guidance
Claims persistence
External identities persist minimized canonical claims by default:
Auth attempt lifecycle
Callbacks use reserve → validate → consume (or retryable failure). See Auth Attempt Lifecycle.
Data retention
Schedule daily pruning:
Testing
Upgrade guidance
Review CHANGELOG before upgrading.
Changelog
See CHANGELOG.
Contributing
See CONTRIBUTING.
Security Vulnerabilities
See SECURITY.md or the GitHub security policy.
Credits
- Godspower Oduose
- All Contributors
License
MIT — see LICENSE.md.
All versions of laravel-sso with dependencies
ext-dom Version *
ext-libxml Version *
ext-openssl Version *
illuminate/contracts Version ^12.0|^13.0
illuminate/database Version ^12.0|^13.0
illuminate/support Version ^12.0|^13.0
robrichards/xmlseclibs Version ^3.1.4
spatie/laravel-package-tools Version ^1.93
ext-zlib Version *