Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

AfiqHamzah's avatar

SSO implementation using passport

Hi, I'm tasked to develop a group of apps that requires that if 1 app is logged in by the user, another system may also automatically logged in as well. When I'm searching on the way to make this possible, I've found 2 solutions:

  1. Use Single Sign On approach by using Oauth2. By using laravel passport
  2. Use laravel shared session. By sharing common session table and common domain name.

I'm intrigued on using the Oauth2. The token authentication may provide additional layer of security. But I'd yet found a viable solution on passing the the token to other apps so that 1 app that is logged in will also enable other system to logged in as well. So I'd had an idea to to share common session and the logged in token will be stored in shared session. This also enables each of the app to share the same tokens which ultimately enable all the system to be logged in whenever one of the app is logged in. But by doing that I may just resort to shared session authentication directly rather thanusing the Oauth2 flow.

Based on the background provided :

  1. Is shared session are not safe for production ?
  2. Is there any way of using oauth2 that enables SSO without sing shared session ?

Diagram on my working SSO implementation :

https://drive.google.com/file/d/1DrWj2PamadT89tHGqhlMIoP4F3U6AKwB/view?usp=sharing

0 likes
0 replies

Please or to participate in this conversation.