如何将客户端凭据作为变量传入Laravel Socialite实现多租户SSO

问题分析 #

你的多租户Laravel应用中，每个租户账户需要独立配置微软SSO的client_id、client_secret和tenant_id，而非硬编码在config/services.php中。尝试的两种方法分别触发配置缺失、数组键错误，本质是SocialiteProviders微软驱动的初始化逻辑和配置键名要求导致的。

解决方案一：修正buildProvider的配置键名 #

第二个方法的错误源于buildProvider期望配置数组用redirect作为回调URL的键名，而非redirect_uri。调整代码如下：

use Illuminate\Support\Facades\Auth;
use Laravel\Socialite\Facades\Socialite;
use SocialiteProviders\Microsoft\MicrosoftExtendSocialite;

public function microsoftLogin()
{
    $ssoSettings = Auth::user()->account->ssoSettings;

    // 提前校验配置完整性，避免后续异常
    abort_if(empty($ssoSettings->client_id) || empty($ssoSettings->client_secret) || empty($ssoSettings->tenant_id), 400, 'SSO配置不完整');

    return Socialite::buildProvider(MicrosoftExtendSocialite::class, [
        'client_id'     => $ssoSettings->client_id,
        'client_secret' => $ssoSettings->client_secret,
        'redirect'      => config('services.microsoft.redirect'), // 改用redirect键
        'tenant_id'     => $ssoSettings->tenant_id,
    ])->redirect();
}

解决方案二：with()方法配合默认配置 #

若倾向使用with()方法，需先在config/services.php中为微软SSO设置空默认配置，避免初始化驱动时触发配置缺失异常：

// config/services.php
'microsoft' => [
    'client_id'     => '',
    'client_secret' => '',
    'redirect'      => env('MICROSOFT_REDIRECT_URI'),
    'tenant_id'     => '',
],

再修改登录方法：

use Illuminate\Support\Facades\Auth;
use Laravel\Socialite\Facades\Socialite;

public function microsoftLogin()
{
    $ssoSettings = Auth::user()->account->ssoSettings;

    abort_if(empty($ssoSettings->client_id) || empty($ssoSettings->client_secret) || empty($ssoSettings->tenant_id), 400, 'SSO配置不完整');

    return Socialite::driver('microsoft')
        ->with([
            'client_id'     => $ssoSettings->client_id,
            'client_secret' => $ssoSettings->client_secret,
            'tenant_id'     => $ssoSettings->tenant_id,
            // 回调地址用config默认值，无需覆盖（除非租户有独立回调地址）
        ])
        ->redirect();
}

回调逻辑补充 #

回调路由中也要使用对应租户的SSO配置获取用户信息，示例：

public function microsoftCallback()
{
    $ssoSettings = Auth::user()->account->ssoSettings;

    $user = Socialite::buildProvider(MicrosoftExtendSocialite::class, [
        'client_id'     => $ssoSettings->client_id,
        'client_secret' => $ssoSettings->client_secret,
        'redirect'      => config('services.microsoft.redirect'),
        'tenant_id'     => $ssoSettings->tenant_id,
    ])->user();

    // 后续处理用户登录/绑定逻辑
}

内容的提问来源于stack exchange，提问作者Fons