oihana/php-auth

Composable PHP authorization toolkit — Casbin RBAC enforcer, JWT/OIDC verification (JWKS), fine-grained capabilities, validation rules and ready-to-use HTTP middlewares for API protection.

dev-main 2026-05-26 09:16 UTC

Requires

• php: >=8.4
• ext-memcached: *
• casbin/casbin: ^4.0
• firebase/php-jwt: ^7.0
• guzzlehttp/guzzle: ^7.10
• oihana/php-enums: dev-main
• oihana/php-exceptions: dev-main
• oihana/php-reflect: dev-main
• oihana/php-schema: dev-main
• oihana/php-system: dev-main
• php-di/php-di: ^7.0
• psr/container: ^2.0
• psr/http-message: ^2.0
• psr/log: ^3.0
• somnambulist/validation: ^1.12

Requires (Dev)

• nunomaduro/collision: ^8.8
• phpdocumentor/shim: ^3.8
• phpunit/phpunit: ^12

MPL-2.0

• Marc Alcaraz

• php
• authorization
• Authentication
• oauth2
• capabilities
• middleware
• auth
• rbac
• jwt
• oidc
• JWKS
• casbin
• api-security

README

Composable PHP authorization toolkit. Part of the Oihana PHP ecosystem, this package combines Casbin RBAC, JWT/OIDC verification, fine-grained capabilities and HTTP middlewares to protect your APIs end‑to‑end.

📚 Documentation

Full API reference (generated with phpDocumentor): https://bcommebois.github.io/oihana-php-auth

User guides (FR + EN) live under wiki/.

📦 Installation

Requires PHP 8.4+. Install via Composer:

composer require oihana/php-auth

✨ What you can do

• Authenticate any request against a Zitadel / Auth0 / Keycloak IdP using a JWKS‑backed JWT validator (cached via Memcached).
• Authorize with Casbin RBAC + domains: route‑level guards, role/permission/policy CRUD, multi‑tenant.
• Restrict sensitive query parameters, filter keys or skin variants with fine‑grained capabilities (subject PARAM:…).
• Validate request bodies via Somnambulist Validation rule catalogues.
• Reuse ready‑made HTTP middlewares (JWT check, authorization, rate‑limit hooks) compatible with any PSR‑15 stack.

Under the hood

• A consistent set of interfaces (CapabilityEnforcerInterface, PermissionSubjectResolverInterface) you can implement against your own persistence layer.
• Pure‑PHP JWT validator built on top of firebase/php-jwt v7.
• Helpers for PSR‑11 Container wiring.
• Strongly‑typed enums and constants — no magic strings.

✅ Running tests

Run all tests:

composer test

Run a specific test file:

composer test ./tests/oihana/auth/SomeTest.php

🛠️ Generate the documentation

We use phpDocumentor to generate documentation into the ./docs folder.

composer doc

🧾 License

Licensed under the Mozilla Public License 2.0 (MPL‑2.0).

👤 About the author

• Author: Marc ALCARAZ (aka eKameleon)
• Email: [e-mail]
• Website: https://www.ooop.fr

🔗 Related packages

• oihana/php-core – core helpers and utilities: https://github.com/BcommeBois/oihana-php-core
• oihana/php-enums – typed constants & enums: https://github.com/BcommeBois/oihana-php-enums
• oihana/php-exceptions – framework exceptions: https://github.com/BcommeBois/oihana-php-exceptions
• oihana/php-reflect – reflection and hydration utilities: https://github.com/BcommeBois/oihana-php-reflect
• oihana/php-schema – Schema.org constants and vocabulary: https://github.com/BcommeBois/oihana-php-schema
• oihana/php-system – framework helpers (controllers, models, request handling): https://github.com/BcommeBois/oihana-php-system