Auth & identity framework for Laravel
A Laravel-native auth and identity framework you bind into your own app. Central login, enterprise SSO (SAML/OIDC), SCIM directory sync, RBAC, billing-fed entitlements and a tamper-evident audit trail, all interface-driven and deny-by-default.
Laravel ID is an auth and identity framework you bind into your own app: central login, enterprise SSO, directory sync, RBAC, billing-driven entitlements and a tamper-evident audit trail. It is UI-free and domain-free. Every capability sits behind a contract you bind, mock, extend or replace, and the whole thing is deny-by-default and verified with tests, PHPStan at max level and composer audit before it ships.
What It Covers
Authentication
Central login and user directory behind a UserDirectory contract, with password and credential handling that stays out of your domain code.
SSO & Federation
A SAML 2.0 identity provider with signed assertions and XSW hardening, a SAML and OIDC relying party with replay protection and JIT provisioning, and an OAuth 2.0 / OIDC back-channel of your own.
Directory Sync (SCIM)
Inbound SCIM 2.0 for Users and Groups plus Google Workspace and Microsoft Entra pull connectors, with deprovisioning that revokes sessions immediately. Outbound provisioning is a generic SCIM client with an outbox, retries and a circuit breaker, users only.
Access Control & RBAC
Org-scoped RBAC with hierarchy roll-down and entitlements, deny-by-default, so every check is explicit rather than assumed. A ReBAC engine and PDP sit alongside it.
MFA & Credentials
Recovery codes, magic links, password reset and a password policy covering length, reuse, expiry and lockout, with TOTP, WebAuthn passkeys and email OTP on top. Breach screening and SMS OTP are contracts you bind.
Audit & Governance
A SHA-256 hash-chained audit trail you can query and stream to a SIEM, plus access-certification campaigns and segregation-of-duties checks over roles and memberships.
Contracts all the way down
The framework is split into kernels (Tenancy, Crypto, Audit, Events, Authorization, Usage) and domain modules (Organization, Identity, Otp, AccessControl, Directory, Provisioning, Federation, SamlIdp, OAuthServer, Governance, TokenVault, ExternalActions, Webhooks, AuditQuery, AuditStreaming). Each is interface-driven: you resolve a contract like Organizations or UserDirectory from the container and get a working implementation, which you can swap for your own without touching the call sites.
Standards and compliance
The docs carry an RFC-by-RFC matrix for OAuth, OIDC, SCIM, SAML, WebAuthn and MCP, grading every row as full, partial, contract-only or not implemented rather than claiming blanket support, plus which parts of the FAPI 2.0 baseline are switchable today. Controls map to SOC 2, ISO 27001, NIS2, GDPR, HIPAA and PCI-DSS, with a threat model alongside.
It does not serve /authorize
This package ships the back-channel: token, introspection, revocation, registration, PAR, device, CIBA, discovery, JWKS, and the crypto and validation behind them. Login, consent, and everything decided at the authorization request are your app's to build. The deployable Cbox ID app implements that half if you would rather not. The package is 0.x, so read UPGRADING.md before crossing a version.
