SSO with Laravel Passport

You can achieve this with passport however you are right about the examples as there are not many or lacking on some steps.

You could to create a new middleware in App1 and App2 side that communicates with identity.mysite.com and gets the user data (token, scopes, etc, id) then it will verify if the token is valid.

On the passport server side you need an endpoint to return whether the token is valid or not and any additional info.

To avoid making too many requests to your passport server i would recommend to create a service that get the TTL of the access token and set it as the time on cache on App1 or App2 for the user data.


This is what I call a resource oriented approach where all the clients(app1, app2...) want to know weather requesting user is authorized to access the resource or not...

Here we need to shift all the authenticating logic to oauth and make all our requesting apps dependent on OAuth. This way if user request app to access resources then if:

  1. Token is present then app will request oauth server to validate given token and if found true then app will provide access to user.

  2. If token is not present then you can solve it by asking for credential and app will transfer user data to oAuth server and validate it respond with the token.

As per my experience I use to implement this approach and I think Laravel Passport is an abstraction layer over top of your authenticating system. You can mold it however you need. There are few more enhancement and advancement can be done but this would work as a basic layer over top of your SSO.