raccount/laravel-sso

Single Sign-On client SDK for RAccount — the Reducates ecosystem identity provider. Implements the full OAuth 2.0 authorization-code + PKCE flow, refresh-token rotation, signed webhooks, and the M2M directory lookup for Laravel 13 applications.

Features

• Login flow: redirect → callback → local session login, with CSRF state and PKCE S256 enforced.
• User resolution: links or provisions local users keyed on the stable sub claim; auto-links verified emails; fully customizable resolver.
• Token lifecycle: encrypted at-rest storage, rotation-aware refresh (invalid_grant = logout, never retry), best-effort revocation on logout.
• Webhooks: HMAC-SHA256 signature verification, ±5 min replay window, event-id deduplication, Laravel events for user created/updated/suspended/reactivated/deleted.
• Directory sync: client-credentials M2M token with caching, cursor pagination, DirectoryUserRetrieved event stream, raccount:directory:sync command.
• Ops: raccount:check diagnostics command, status middleware, exclusive-SSO middleware.
• Octane-ready: no static state; tokens in encrypted columns; machine tokens in your cache store.

Requirements

• PHP 8.3+
• Laravel 13
• A confidential RAccount client (client id/secret + registered redirect URI)

Installation

composer require raccount/laravel-sso
php artisan vendor:publish --tag=raccount-sso-config
php artisan vendor:publish --tag=raccount-sso-migrations
php artisan migrate

The service provider and Raccount facade are auto-discovered.

Quickstart

1. Ask the RAccount admin to register your application (name, logo, redirect URI https://your-app/raccount/callback, scopes profile email, confidential client).
2. Configure your environment:

RACCOUNT_SSO_SERVER_URL=https://account.reducates.com
RACCOUNT_SSO_CLIENT_ID=your-client-id
RACCOUNT_SSO_CLIENT_SECRET=your-client-secret
RACCOUNT_SSO_REDIRECT_URI=https://your-app/raccount/callback

RACCOUNT_SSO_SERVER_URL is not hardcoded — https://account.reducates.com above is the built-in default. Omit the variable to use it, or point it at whichever RAccount instance serves this deployment (staging or private); any HTTPS base URL works.

1. Add a login button to your login page:

<x-raccount::button class="btn btn-primary" />

1. (Optional) force SSO-only authentication by appending the middleware to your web group:

// bootstrap/app.php
->withMiddleware(function (Middleware $middleware): void {
    $middleware->web(append: [
        \Raccount\Sso\Http\Middleware\RedirectAuthRoutesToSso::class,
        \Raccount\Sso\Http\Middleware\EnsureRaccountAccountActive::class,
    ]);
})

and enable enforcement in config/raccount-sso.php (there is no env var for this key):

'middleware' => ['enforce_status' => true],

1. Verify your setup:

php artisan raccount:check

Documentation

• Installation
• Configuration reference
• Login/logout flow
• Webhooks
• Directory sync
• Security model
• Octane notes
• Upgrading

Security

If you discover a security vulnerability, please review docs/security.md and report it privately using this repository's Report a vulnerability feature (the Security tab → Report a vulnerability, i.e. GitHub private security advisories) — do not open a public issue.

License

The MIT License (MIT). See LICENSE for more information.