Search by

cboxdk / laravel-id

cboxdk

cboxdk/laravel-id: a Laravel-native auth and identity framework. AuthN, SSO/SAML, SCIM, OAuth/OIDC provider, RBAC, billing-fed entitlements, tamper-evident audit.

Package info

github.com/cboxdk/laravel-id

pkg:composer/cboxdk/laravel-id

Security

Advisories: 0

Aikido package health analysis

Transparency log

Statistics

Installs: 5 765

Dependents: 2

Suggesters: 0

Stars: 2

Open Issues: 0

v2.6.0 2026-11-11 22:11 UTC

Requires

Requires (Dev)

Suggests

None

Provides

None

Conflicts

None

Replaces

None

MIT 1bd72bd90bc8a68d02a7b9aaa2de1371f6583699

AuthenticationoauthSSOAuditidentitylaravelrbacsamloidcscimcbox

Published on Packagist.org on 2026-11-11 22:11 UTC

This package is auto-updated.

Last update: 2026-11-12 15:20:45 UTC

README

cboxdk/laravel-id is a Laravel-native auth and identity framework. Central login, enterprise SSO, directory sync, RBAC, billing-driven entitlements and a tamper-evident audit trail: all interface-driven, deny-by-default, and verified (tests + PHPStan level max + composer audit) before it ships.

UI-free and domain-free: every capability sits behind a contract you bind, mock, extend or replace.

Install

composer require cboxdk/laravel-id
php -r "echo base64_encode(random_bytes(32)).PHP_EOL;"   # set as CBOX_ID_CRYPTO_KEY
php artisan migrate

A taste

use Cbox\Id\Organization\Contracts\Organizations;
use Cbox\Id\Organization\ValueObjects\NewOrganization;
use Cbox\Id\Identity\Contracts\Subjects;

$org  = app(Organizations::class)->create(new NewOrganization('Northwind', 'northwind'));
$user = app(Subjects::class)->create('ida@northwind.test', 'Ida', password: 's3cret');

Environments first. Organization, User and the other domain models are environment-owned and deny-by-default — the calls above need an environment in context (a request resolves one from its host, or set cbox-id.environments.default; the deployable app creates the first one from its installer, and the rest from its platform console). See Environments & the isolation model.

What's supported

Grades are against this package's own src/ — never the deployable app or an add-on. Full = ships and is tested · Partial = works, with the named limit · Contract only = you bind the implementation · Host = your app writes the interactive half · No = not implemented. Every row is expanded, with its caveats, in Standards & conformance and Feature support.

Area Support
OAuth 2.0 Full authorization-code + PKCE S256 (RFC 7636), client-credentials, refresh with rotation + reuse detection, RFC 8414 / 9728 metadata · Partial introspection (RFC 7662), revocation (RFC 7009), device grant (RFC 8628), PAR (RFC 9126), DPoP (RFC 9449), token exchange (RFC 8693), resource indicators (RFC 8707), DCR (RFC 7591/7592), step-up challenge (RFC 9470: acr/auth_time on access tokens and introspection, insufficient_user_authentication builder) · No ROPC, implicit, mTLS (RFC 8705), JAR (RFC 9101), JARM
OpenID Connect Full discovery, JWKS, UserInfo, RP-Initiated Logout, Back-Channel Logout · Partial id_token (code flow + query mode only), CIBA (poll only) · Host /authorize, consent, prompt/max_age/acr_values gating (the package ships the AuthenticationRequirement check your /authorize calls), RFC 9207 iss · No front-channel logout, pairwise sub
SAML 2.0 (IdP role) Full signed assertions and responses, RSA-SHA256, HTTP-Redirect + HTTP-POST, signed-AuthnRequest verification, XSW-hardened, SP-initiated SLO · No HTTP-Artifact, outbound assertion encryption, unsolicited SSO, global logout fan-out
SAML 2.0 / OIDC (relying party) Full ACS with replay protection, JIT provisioning, JWKS rotation, state/nonce, a catalogue of 15 sign-in providers (incl. LinkedIn, Bitbucket, Xero, Intuit), setup guides for 20 enterprise IdPs · Partial SLO (receive-only), inbound assertion decryption · No signed outbound AuthnRequest, PKCE on the outbound OIDC leg
SCIM 2.0 Full Users + Groups CRUD, Enterprise User extension (RFC 7643), the full RFC 7644 filter grammar, sorting, ETags (If-Match / If-None-Match), /Bulk with bulkId references, errors and discovery; held to Microsoft Entra ID's and Okta's published test cases · Partial PATCH (value-path filters; one stored email), attribute selection · No /.search, /Me
Provisioning out Partial generic SCIM 2.0 client with outbox, retries, circuit breaker, SSRF guard — users only, no group push, no vendor connectors
Directory in Full SCIM push, Google Workspace and Microsoft Entra pull; deprovision revokes sessions immediately
MFA & credentials Full recovery codes, magic links, password reset, password policy (length/reuse/expiry/lockout) · Partial TOTP (RFC 6238, SHA-1/6/30 fixed), WebAuthn/passkeys (ES256+RS256, none + self-attested packed), email OTP, SMS OTP (Twilio, MessageBird, Bird, 46elks over HTTP; toll-fraud guard) and an SMS second factor (off by default per environment) · Contract only breach screening · No HOTP (RFC 4226), complexity classes
Authorization Full org-scoped RBAC with hierarchy roll-down, entitlements, POST /oauth/decisions · Partial ReBAC engine (uncached), the PDP (ReBAC-only) · No wildcard permissions, role-inherits-role, XACML
Audit Full SHA-256 hash chain, query + pull stream, retention · Partial signed checkpoints (nothing schedules them), SIEM streaming (HTTP transport only: Splunk HEC / ECS / GELF / CEF / JSON) · No tamper-proof storage, OCSF
Governance Full access-certification campaigns · Partial Segregation of Duties — both cover roles and memberships only
Crypto Full XChaCha20-Poly1305 AEAD at rest, signing-key rotation with overlap, closed RS256/ES256/EdDSA allow-list (RFC 8725, RFC 8037), JWKS (RFC 7517), at+jwt (RFC 9068) · Contract only HSM/KMS · No JWE (RFC 7516), master-key rotation
Delivery Full transactional outbox, webhooks (HMAC-SHA256, retries, circuit breaker; per endpoint either the Cbox signature or Standard Webhooks, with receiver-side verifiers for both), six inline hook points · Partial at-least-once only; no secret-rotation overlap window

This package does not serve /authorize. It ships the back-channel — token, introspection, revocation, registration, PAR, device, CIBA, discovery, JWKS — and the crypto and validation behind them. Login, consent, and everything decided at the authorization request are your app's, and are marked Host above. The deployable cbox-id app implements that half if you would rather not.

Modules

Layer Modules
Kernels Tenancy · Crypto · Audit · Events · Authorization · Usage
Domain Organization · Identity · Otp · AccessControl · Directory (inbound SCIM + pull connectors) · Provisioning (outbound SCIM) · Federation (SSO relying party) · SamlIdp (SAML 2.0 IdP) · OAuthServer (OAuth 2.0 / OIDC) · Governance (access reviews, SoD) · TokenVault · FeatureFlags · Pipes (connected third-party accounts) · ExternalActions (inline hooks) · Webhooks · AuditQuery · AuditStreaming
HTTP & ops Api (OAuth/OIDC/SCIM/SAML endpoints) · Platform (operators + the self-serve account/project plane) · Maintenance (retention) · Console (17 cbox-id:* commands)

Documentation

Full docs live in docs/:

License

MIT. Published on Packagist as a 1.x release under semantic versioning — installable via composer require cboxdk/laravel-id. Breaking changes wait for a major; every one that has happened is written up in UPGRADING.md.

Membership creation, role change, removal and invitation acceptance publish a positive directory_revision and the affected membership_id in the domain event. The revision advances in the same database transaction as the mutation and is local to the organization. Relays can deliver those mutations out of order. Consumers can compare their revisions with the revision of a complete organization roster to prevent an older grant from restoring access.