FOSOAuthServerBundle

FOSOAuthServerBundle is a Symfony bundle that implements the server side of OAuth2, letting a Symfony application issue and validate access tokens, authorization codes, and refresh tokens for third-party clients. It wraps the underlying friendsofsymfony/oauth2-php library with Symfony-specific integration: Doctrine ORM and MongoDB ODM storage backends for clients/tokens, a Security-bundle-compatible authentication provider, and controllers/forms for the OAuth2 authorization flow.

Because it plugs into Symfony’s Security component, protected resources use the same access-control mechanisms (voters, firewalls) as any other authenticated request, with the OAuth2 token standing in for a session-based credential. The project has been in low-maintenance mode since 2019, so teams evaluating it for new work should weigh that against actively maintained OAuth2 server alternatives (e.g. League OAuth2 Server).

What You Get

• Doctrine ORM and MongoDB ODM entity/document mappings for OAuth2 clients, access tokens, refresh tokens, and auth codes
• A Security-bundle-compatible OAuth token authentication provider for protecting API endpoints
• Controllers and Twig templates for the authorization endpoint and consent/authorize form flow
• Console commands for creating and managing OAuth2 clients
• Event dispatching around token issuance for custom hooks (e.g. scope validation)

Common Use Cases

• Exposing a first-party API that third-party or mobile clients authenticate against via OAuth2
• Implementing the authorization-code and client-credentials grant flows in a Symfony app
• Protecting API routes with OAuth2 bearer tokens through Symfony’s existing Security firewall configuration
• Issuing and rotating refresh tokens for long-lived client sessions

Under The Hood

Architecture - The bundle layers Symfony-specific glue around friendsofsymfony/oauth2-php, which implements the OAuth2 protocol logic itself. Storage/ adapts that library’s storage interface to Doctrine, backed by Entity//Document/ classes for Client, AccessToken, RefreshToken, and AuthCode. Security/ provides an authentication provider and token factory that plug into Symfony’s Security component, so a protected controller can rely on the standard Security service rather than checking OAuth tokens manually. Controller/ implements the /oauth/v2/auth and /oauth/v2/token endpoints along with the consent screen, using Form/ for the authorize form, and Command/ exposes console tools for client management. Event/ fires events around token issuance for applications that need custom scope or client validation. Tech Stack - PHP 7.2/8.0-era Symfony bundle (4.4/5.1 series) depending on friendsofsymfony/oauth2-php, symfony/security-bundle, symfony/framework-bundle, and symfony/twig-bundle, with optional Doctrine ORM/MongoDB ODM dev dependencies for storage. Code Quality - Tests/ covers the security provider, storage adapters, and controllers with PHPUnit and PHPStan static analysis configured in CI, though the project’s TODO in its own README (“more tests”) and its inactive status since 2019 mean newer PHP/Symfony compatibility isn’t actively verified. API Design - The bundle mirrors the standard OAuth2 spec’s endpoint and grant-type vocabulary directly, and its Security integration is designed so protected controllers use Symfony’s normal #[IsGranted]/firewall configuration rather than a bundle-specific authorization API.