Your identity.
Your infrastructure.

// config/services.php — add this entry to the returned array:
'openidconnect' => [
    'base_url'      => env('SSO_ISSUER'),
    'client_id'     => env('SSO_CLIENT_ID'),
    'client_secret' => env('SSO_CLIENT_SECRET'),
    'redirect'      => env('SSO_REDIRECT_URI'),
],

// In your controllers: use Laravel\Socialite\Facades\Socialite;

// Login action:
return Socialite::driver('openidconnect')->redirect();

// Callback action:
$identity = Socialite::driver('openidconnect')->user();
$subject = $identity->getId();

import * as oidc from 'openid-client';

const config = await oidc.discovery(
  new URL(process.env.SSO_ISSUER),
  process.env.SSO_CLIENT_ID,
  process.env.SSO_CLIENT_SECRET,
);

// Generate separately for each login; save in the user's session.
const verifier = oidc.randomPKCECodeVerifier();
const challenge = await oidc.calculatePKCECodeChallenge(verifier);
const authorizationUrl = oidc.buildAuthorizationUrl(config, {
  redirect_uri: process.env.SSO_REDIRECT_URI,
  scope: 'openid profile email',
  code_challenge: challenge,
  code_challenge_method: 'S256',
});

import os
from flask import Flask
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = os.environ['FLASK_SECRET_KEY']
oauth = OAuth(app)

oauth.register(
    name='sso',
    client_id=os.environ['SSO_CLIENT_ID'],
    client_secret=os.environ['SSO_CLIENT_SECRET'],
    server_metadata_url=(
        os.environ['SSO_ISSUER'].rstrip('/')
        + '/.well-known/openid-configuration'
    ),
    client_kwargs={
        'scope': 'openid profile email',
        'code_challenge_method': 'S256',
    },
)

package auth

import (
    "context"
    "os"
    "github.com/coreos/go-oidc/v3/oidc"
    "golang.org/x/oauth2"
)

func Configure(ctx context.Context) (*oauth2.Config, *oidc.IDTokenVerifier, error) {
    provider, err := oidc.NewProvider(ctx, os.Getenv("SSO_ISSUER"))
    if err != nil { return nil, nil, err }
    config := &oauth2.Config{
        ClientID: os.Getenv("SSO_CLIENT_ID"),
        ClientSecret: os.Getenv("SSO_CLIENT_SECRET"),
        RedirectURL: os.Getenv("SSO_REDIRECT_URI"),
        Endpoint: provider.Endpoint(),
        Scopes: []string{oidc.ScopeOpenID, "profile", "email"},
    }
    verifier := provider.Verifier(&oidc.Config{ClientID: config.ClientID})
    return config, verifier, nil
}

# Replace this with your Laravel SSO server URL.
export SSO_ISSUER="https://auth.example.com"

curl --fail --silent --show-error \
  "$SSO_ISSUER/.well-known/openid-configuration"

# Your OIDC library discovers these URLs from the JSON:
# authorization_endpoint, token_endpoint, jwks_uri,
# userinfo_endpoint and end_session_endpoint.