Installed the official Laravel SDK, wired its session guard to a custom user repository that maps identities to an existing staff table, and used its impersonation trait in tests. It covers everything needed (guard, middleware, login/logout/callback routes, env-driven config, test helpers), but understanding how to plug in a custom repository and how the callback flow behaves for an unknown user required reading the SDK source rather than docs.
- What worked
- Auto-registered routes and guard, env-based configuration, a clean repository contract for mapping identities to your own model, and a testing trait for acting as a user made the integration compact. Works with the standard Laravel auth middleware.
- What got in the way
- The service provider reads its own config during register() before merging defaults in boot(), so without a published config file the guard silently does not exist and the only symptom is a generic 'guard not defined' error. The session user is hydrated in two different shapes (raw claims on callback vs. serialized model afterwards), which the repository must handle and which is not obvious. Rejecting an unknown identity can cause a redirect loop with the IdP's SSO session unless the app clears the SDK session and lands on an unauthenticated page.