jostkleigrewe/lib-php-eurip-sso

OIDC Client Library and Symfony Bundle for EURIP SSO

v0.2.1 2026-02-01 00:04 UTC

Requires

• php: >=8.2
• psr/http-client: ^1.0
• psr/http-factory: ^1.0
• psr/http-message: ^1.1 || ^2.0
• psr/log: ^3.0

Requires (Dev)

• doctrine/orm: ^3.0
• nyholm/psr7: ^1.8
• phpstan/phpstan: ^2.0
• phpunit/phpunit: ^11.0 || ^12.0
• symfony/cache: ^7.0 || ^8.0
• symfony/framework-bundle: ^7.0 || ^8.0
• symfony/property-access: ^7.0 || ^8.0
• symfony/security-bundle: ^7.0 || ^8.0
• symplify/easy-coding-standard: ^12.0 || ^13.0

Suggests

• doctrine/orm: Required for DoctrineOidcUserProvider
• guzzlehttp/guzzle: HTTP client implementation
• nyholm/psr7: PSR-7/PSR-17 implementation
• symfony/cache: Required for discovery caching
• symfony/framework-bundle: Required for Symfony bundle integration
• symfony/http-client: HTTP client implementation for Symfony
• symfony/property-access: Required for DoctrineOidcUserProvider
• symfony/security-bundle: Required for security authenticator

MIT

• symfony
• Authentication
• oauth2
• SSO
• oidc

README

OIDC Client Library and Symfony Bundle for Single Sign-On.

🇩🇪 Deutsche Version

Features

• Zero-Code Integration - Complete OIDC auth via configuration only
• OIDC Authorization Code Flow with PKCE (S256)
• Auto-Discovery via .well-known/openid-configuration
• Dual-URL Support (internal/public issuer for Docker/K8s)
• Automatic User Provisioning with Doctrine
• Hybrid User Strategy (sync SSO data, preserve local data)
• Extensive Event System (6 events)
• PSR-3 Logging, PSR-18 HTTP Client

Requirements

• PHP 8.2+
• Symfony 7.0+ or 8.0+
• PSR-18 HTTP Client

Installation

composer require jostkleigrewe/lib-php-eurip-sso

// config/bundles.php
Jostkleigrewe\Sso\Bundle\EuripSsoBundle::class => ['all' => true],

Quick Start: Zero-Code Integration

1. Configure Bundle

# config/packages/eurip_sso.yaml
eurip_sso:
    issuer: '%env(SSO_ISSUER_URL)%'
    client_id: '%env(OIDC_CLIENT_ID)%'
    redirect_uri: '%env(APP_URL)%/auth/callback'

    controller:
        enabled: true

    routes:
        login: /auth/login
        callback: /auth/callback
        logout: /auth/logout
        after_login: /
        profile: /auth/profile    # optional
        debug: /auth/debug        # optional

    user_provider:
        enabled: true
        entity: App\Entity\User
        mapping:
            subject: oidcSubject
            issuer: oidcIssuer
            email: email
            roles: roles
            external_roles: externalRoles
        sync_on_login: true
        auto_create: true

2. Configure Security

# config/packages/security.yaml
security:
    providers:
        app_user_provider:
            id: Jostkleigrewe\Sso\Bundle\Security\DoctrineOidcUserProvider

    firewalls:
        main:
            lazy: true
            provider: app_user_provider
            custom_authenticator: App\Security\NoopAuthenticator

Done! Routes available:

• /auth/login - Start login
• /auth/callback - SSO callback
• /auth/logout - Logout
• /auth/profile - User profile
• /auth/debug - OIDC config

Events

Event	When	Purpose
OidcPreLoginEvent	Before IdP redirect	Modify scopes, cancel
OidcLoginSuccessEvent	After login	Modify roles, redirect
OidcLoginFailureEvent	On error	Custom error response
OidcUserCreatedEvent	New user	Modify before persist
OidcUserUpdatedEvent	User updated	Modify before flush
OidcPreLogoutEvent	Before logout	Skip SSO logout

Example: Add Role Based on Claims

#[AsEventListener(event: OidcLoginSuccessEvent::NAME)]
class AddAdminRoleListener
{
    public function __invoke(OidcLoginSuccessEvent $event): void
    {
        if (in_array('admin', $event->claims['groups'] ?? [])) {
            $event->addRole('ROLE_ADMIN');
        }
    }
}

Configuration Reference

eurip_sso:
    # Required
    issuer: '%env(SSO_ISSUER_URL)%'
    client_id: '%env(OIDC_CLIENT_ID)%'
    redirect_uri: '%env(APP_URL)%/auth/callback'

    # Optional
    client_secret: null
    public_issuer: null              # For Docker/K8s
    scopes: [openid, profile, email]

    cache:
        enabled: true
        ttl: 3600
        pool: cache.app

    controller:
        enabled: false

    routes:
        login: /auth/login
        callback: /auth/callback
        logout: /auth/logout
        after_login: /
        after_logout: /
        profile: null
        debug: null
        test: null

    user_provider:
        enabled: false
        entity: null
        mapping:
            subject: oidcSubject
            issuer: oidcIssuer
            email: email
            roles: roles
            external_roles: externalRoles
        claims_sync: {}
        roles_claim: roles
        default_roles: [ROLE_USER]
        sync_on_login: true
        auto_create: true

Standalone Usage

$client = OidcClient::fromDiscovery(
    issuer: 'https://sso.example.com',
    clientId: 'my-app',
    redirectUri: 'https://app.com/callback',
    httpClient: $psrClient,
    requestFactory: $requestFactory,
    streamFactory: $streamFactory,
);

$authData = $client->buildAuthorizationUrl(['openid', 'profile']);
// Redirect to $authData['url']

// Callback
$tokens = $client->exchangeCode($code, $authData['code_verifier']);
$claims = $client->decodeIdToken($tokens->idToken);
$client->validateClaims($claims, $authData['nonce']);

License

MIT License