OAuth2 provider and Laravel Breeze

To address your questions regarding the integration of OAuth2 with Laravel Breeze and the setup of a centralized identity and access management system using Laravel Passport, let's break down the solution:

1. Using Laravel Breeze for the Apps

Is using Breeze appropriate?

Laravel Breeze is a simple and minimal implementation of Laravel's authentication features. It provides a basic starting point for authentication, which can be extended to support OAuth2. Since you are planning to use OAuth2 for authentication via a centralized CIAM system, Breeze can be a good choice for the individual apps as it allows you to quickly set up the basic authentication scaffolding. However, you will need to extend it to handle OAuth2 flows.

2. Proposed Authentication Flow

Is the flow correct?

Your proposed flow is generally correct for an OAuth2 implementation. Here's a refined version of the flow:

1. User Initiates Login: The user clicks on a login button in one of the apps.
2. Redirect to CIAM: The app redirects the user to the CIAM's authorization endpoint (/oauth/authorize).
3. CIAM Handles Authentication: The CIAM app presents a login form with options for Microsoft and Google.
4. Authorization Code Grant: Once authenticated, CIAM redirects back to the app with an authorization code.
5. Token Exchange: The app exchanges the authorization code for an access token (and optionally a refresh token) by making a request to the CIAM's token endpoint (/oauth/token).
6. Access Resource: The app uses the access token to authenticate API requests to the CIAM or other services.
7. User Session Management: The app manages the user session using the access token, possibly storing it in a session or a cookie.

3. Custom User Provider

Do you need a custom user provider?

Yes, if you do not want to store users in the app's database and instead rely on the CIAM for user information, you will need a custom user provider. This custom provider will authenticate users based on the access token and fetch user details from the CIAM.

Here's a basic outline of how you might implement a custom user provider:

namespace App\Providers;

use Illuminate\Contracts\Auth\UserProvider;
use Illuminate\Contracts\Auth\Authenticatable;

class CustomUserProvider implements UserProvider
{
    public function retrieveById($identifier)
    {
        // Fetch user by identifier from CIAM
    }

    public function retrieveByToken($identifier, $token)
    {
        // Fetch user by token from CIAM
    }

    public function updateRememberToken(Authenticatable $user, $token)
    {
        // Update remember token if necessary
    }

    public function retrieveByCredentials(array $credentials)
    {
        // Fetch user by credentials from CIAM
    }

    public function validateCredentials(Authenticatable $user, array $credentials)
    {
        // Validate user credentials
    }
}

Conclusion

• Breeze: Suitable for setting up basic authentication scaffolding.
• Flow: Your flow is mostly correct; ensure you handle token exchange and session management properly.
• Custom User Provider: Necessary if you want to avoid storing user data in each app's database.

By following these steps, you should be able to implement a centralized authentication system using Laravel Passport and integrate it with your Laravel apps using Breeze.