Become a sponsor to Mathieu Santostefano

Hi! 👋

🧑‍💻 I've been a web developer since 2010
🐘 I love the PHP ecosystem, with a soft spot for @Symfony
🎙 I speak at conferences: SymfonyCon, SymfonyLive, AFUP Day, API Platform Con and Confoo
✍ I write on my personal blog and the SensioLabs blog, and previously on JoliCode's blog
🌐 I'm half-French, half-Italian. French is my native language, I also speak English, and I'm learning Italian

Native OIDC login in Symfony 8.2

Symfony now speaks OpenID Connect out of the box. I contributed the oidc_login authenticator, which brings the OIDC Authorization Code Flow natively into the Security component: PKCE, the code exchange, ID token signature verification, logout and refresh, all handled for you. "Log in with …" went from a bundle-and-glue job to a few lines of security.yaml. It ships with Symfony 8.2.

If your company runs Symfony and authenticates users, that work is now in your framework, maintained by the core team and the community, at no cost to you. This is what I would like to keep doing.

And if you maintain a product that other people install — a CMS, an e-commerce platform, a PIM, a CRM, a helpdesk — this lands in your stack for free. Your own customers get "Log in with our company identity provider" without you writing, testing or maintaining a single line of OIDC. Enterprise SSO stops being a roadmap item and becomes a line of configuration. That leverage is the whole point, and it is what sponsoring me funds.

This work was not sponsored. If it helps your team, you can sponsor me after the fact to say thanks.

Where I contribute

• Symfony, as a Core Team Member
• Security: the native OIDC Authorization Code Flow authenticator, from PKCE and ID token signature verification to RP-Initiated Logout and mix-up attack hardening. Ships with Symfony 8.2
• Translation: I contributed the Translation Providers subsystem itself, then the Loco and Lokalise providers, plus work on the Phrase one. Also the PhpAstExtractor, the extraction performance work on large codebases, and the translation:extract command
• Mailer: the Sweego and Resend bridges, with their webhook signature verification and attachment support
• Notifier: the Sweego and Yunpian bridges
• Validator: the CssColor constraint
• FrameworkBundle: HttpClientAssertionsTrait, to assert outgoing HTTP calls in tests
• Serializer: the CSV injection fix in CsvEncoder
• Symfony AI: several bridges for local and sovereign AI providers, inference platforms and AI gateways
• Maintainer of php-translation
• Contributor to docker-starter and Castor
• Clever Cloud Ambassador: I maintain a PHP SDK for the Clever Cloud APIs

You'll find my name in a few other projects' committer lists ;)

Sponsoring me buys framework-level work that your team can leverage in their projects. If you are willing and able, it helps me keep going.

Thank you 🙂