Laravel SSO Laravel SSO

v2.0.0

The OpenID Connect layer becomes part of the application, and the consent screen is yours to word.

On this page 5

A major release. The OpenID Connect layer no longer comes from a package: it is part of the application, on top of Passport, which remains the OAuth 2.0 server. Relying parties may notice some of the changes below, so read Upgrading before you deploy.

Release notes on GitHub · Every change since v1.0.2

Highlights

  • OpenID Connect built in. Discovery, the key set, ID Tokens, claims, UserInfo, introspection, revocation and logout live in app/Oidc, each behind an interface, so any part can be replaced by binding another class. admin9/laravel-oidc-server is gone.
  • ID Tokens describe the sign-in. They carry the nonce sent to /oauth/authorize and the real auth_time. max_age and prompt=none are honoured, and ID Tokens have a lifetime of their own.
  • A consent screen you word. A Consent tab in App settings sets the heading, the message, what each scope says, the signed-in account, remembered approvals and links to your policies, with a live preview.
  • Single-page applications. Browser applications can call the protocol endpoints once their origin is listed in SSO_CORS_ALLOWED_ORIGINS.

Added

  • Logout accepts client_id and POST, and asks the user to confirm when no valid id_token_hint names them.
  • Signing keys are read from PASSPORT_PRIVATE_KEY and PASSPORT_PUBLIC_KEY when they are set, as Passport does. Key ids are unchanged.
  • The Sessions page searches, filters and pages both of its lists.
  • Every listing pages by number, with the pages at the bottom right, and the access, managers and audit lists are searched and paged like the rest.

Changed

  • Introspection answers confidential clients only.
  • Introspection and revocation search every token type, and an unknown token_type_hint is ignored, as RFC 7662 and RFC 7009 ask.
  • UserInfo requires the openid scope. A missing or unusable token gets 401 with invalid_token and a Bearer challenge, whatever the request accepts.
  • A refreshed ID Token keeps the original auth_time and carries no nonce.
  • config/oidc-server.php is replaced by config/oidc.php.

Fixed

  • Approving or denying on the consent screen, or signing in to an application that skips it, now reaches the application. The browser used to stay on this server with the authorization already made.
  • A client_id that is not a UUID fails client authentication instead of raising an error on PostgreSQL.
  • Disabled applications can no longer authenticate as clients.

Upgrading

  1. Run composer install, then php artisan migrate. The migration adds the columns that record a sign-in's nonce and auth_time.
  2. Move any change you made to config/oidc-server.php into config/oidc.php, then delete the old file.
  3. Rebuild the front end with npm ci and npm run build.
  4. Run php artisan optimize:clear, then php artisan optimize in production.
  5. List the origins of any single-page application in SSO_CORS_ALLOWED_ORIGINS.
  6. Check your relying parties against Changed. Those that introspect as a public client, or send nonce only to the token endpoint, need updating.