Keycloak Socialite Provider

This package is a Keycloak OAuth2 provider for Laravel Socialite, part of the community-maintained Socialite Providers collection. It plugs into Laravel’s Socialite authentication layer to add Keycloak as a login provider, handling the OpenID Connect authorization, token, and userinfo endpoints against a configurable Keycloak server URL and realm.

Beyond the standard OAuth2 login flow, it maps Keycloak userinfo claims (sub, preferred_username, name, email) onto a Socialite user and provides a helper for building Keycloak logout URLs that supports both pre- and post-v18 logout semantics, including post_logout_redirect_uri, client_id, and id_token_hint parameters.

What You Get

• A Keycloak OAuth2/OpenID Connect provider for Laravel Socialite
• Configurable Keycloak base URL and realm via config/services.php
• Automatic mapping of Keycloak userinfo claims to a Socialite user
• A getLogoutUrl helper supporting Keycloak v18+ and earlier logout flows
• An event listener class to register the provider with Socialite

Common Use Cases

• Adding Keycloak single sign-on to a Laravel application
• Authenticating users against a self-hosted Keycloak realm via OpenID Connect
• Implementing Keycloak-backed login and logout in Laravel with redirect handling

Under The Hood

Architecture - The package contains two classes. Provider extends SocialiteProviders\Manager\OAuth2\AbstractProvider and overrides getAuthUrl, getTokenUrl, and getUserByToken to target Keycloak’s /realms/{realm}/protocol/openid-connect/* endpoints, with getBaseUrl composing the server URL and realm. mapUserToObject converts the userinfo response into a Socialite User, and getLogoutUrl builds RP-initiated logout URLs. KeycloakExtendSocialite wires the provider into Socialite when the SocialiteWasCalled event fires.

Tech Stack - Pure PHP (^8.0) depending only on socialiteproviders/manager (^4.4), which brings in Laravel Socialite and Guzzle. Autoloading is PSR-4 under the SocialiteProviders\Keycloak namespace; there is no build step or additional runtime footprint.

Code Quality - The code is small and focused - a single provider plus a listener - following the established conventions of the Socialite Providers organization. There are no bundled unit tests in the repository (shared tooling lives in the umbrella providers repo), but the surface area is minimal and stable, and it reflects the openid scope and claim mapping expected of a Keycloak client.

API Design - Integration follows the standard Socialite pattern: add a services config block, register the SocialiteWasCalled listener, then call Socialite::driver(‘keycloak’). The additional base_url and realms config keys keep Keycloak-specific setup declarative, and the logout helper exposes Keycloak’s version-specific parameters through a single ergonomic method.