Download the PHP package juniyasyos/nexaid-client without Composer

Auth Bridge Client

Laravel package for IAM Single Sign-On (SSO), JWT verification, and JIT user provisioning.

Why use this package?

This package is designed for client applications that need to:

• authenticate users via IAM
• provision users automatically during login
• synchronize roles and application access
• verify tokens on every request
• support optional unit kerja sync

Highlights

• ✅ Minimal setup for a Laravel client
• ✅ IIS-compatible JWT verification
• ✅ JIT user provisioning from the IAM token
• ✅ Optional role sync with Spatie Permission
• ✅ Built-in IAM sync endpoints for user/role data
• ✅ Optional Livewire app switcher for current IAM applications

Requirements

• PHP ^8.1
• Laravel ^10.0 | ^11.0 | ^12.0
• firebase/php-jwt
• spatie/laravel-permission (optional)

Quick setup

1. Install the package

2. Publish config

3. Run migrations

4. Set environment variables

5. Configure your User model

Use status instead of active. The package expects status values like active, inactive, or suspended.

6. Configure routes

The package already registers the main IAM routes automatically when enabled.

If you need protected pages, use middleware:

7. Add a login link

Use the built-in login route:

Configuration overview

Open config/iam.php and adjust the following sections.

SSO settings

• iam.app_key — IAM application key
• iam.jwt_secret — shared JWT secret for validating tokens
• iam.base_url — public base URL of the IAM server (for browser redirects)
• iam.backchannel_url — internal base URL of the IAM server (for server-to-server API calls, e.g. Docker networking)
• iam.login_route / iam.callback_route — local login/callback URLs
• iam.default_redirect_after_login — where to send users after login
• iam.guard — auth guard used by default

User sync settings

• iam.user_fields — map database columns to JWT claims
• iam.identifier_field — primary field used to identify users
• iam.sync_users — exposes /api/iam/sync-users for IAM data requests
• iam.sync_roles — enable role sync during provisioning

Token verification

• iam.verify_each_request — validate token on every request
• iam.attach_verify_middleware — automatically add iam.verify into the web middleware group

Unit Kerja sync (optional)

• iam.unit_kerja_field — JWT claim name for unit/org data
• iam.require_unit_kerja — reject login if unit/org is missing
• iam.sync_unit_kerja — sync unitKerjas() relation on the user model
• iam.unit_kerja_model — model for unit/org records

Routes registered by the package

The package exposes these routes when enabled:

Route API IAM didefinisikan di routes/iam-api.php, sedangkan route web SSO didefinisikan di routes/iam-client.php.

• iam.sso.login — redirect user to IAM login
• iam.sso.callback — handle callback and provisioning
• iam.logout — logout and clear IAM session
• iam.sync-users — endpoint permintaan data user dari client (read-only)
• iam.sync-roles — endpoint permintaan data role dari client (read-only)
• iam.client-roles — alias endpoint permintaan data role dari client (read-only)
• iam.push-roles — endpoint sinkronisasi role oleh IAM ke client app
• iam.push-users — endpoint sinkronisasi user oleh IAM ke client app
• iam.health — health check endpoint

Middleware aliases

• iam.auth — ensures the user is authenticated
• iam.verify — verifies token on each request
• iam.backchannel.verify — verifies IAM back-channel payload signatures

Usage steps for client apps

1. Install the package and publish config.
2. Run migrations.
3. Set IAM_ENABLED=true, IAM_APP_KEY, IAM_JWT_SECRET, and IAM_BASE_URL.
4. Confirm your User model has iam_id, email, name, and status.
5. Protect routes with iam.auth:web.
6. Add a login link using route('iam.sso.login').
7. If needed, publish views for customization:

Example token payload

IAM should send a JWT payload like:

Custom field mapping

Update config/iam.php:

Events

A successful login dispatches the IamAuthenticated event. Use it for auditing or custom actions.

License

This project is proprietary software.

Copyright © 2026 Ahmad Ilyas.

All Rights Reserved.

No permission is granted to use, modify, distribute, or sublicense this software without explicit written approval.