Saml2 Bridge Bundle Laravel Package

Technical Evaluation

Architecture Fit

• Pros:

  • Leverages Symfony bundle architecture, aligning with Laravel’s ecosystem via Symfony Bridge (e.g., symfony/http-foundation compatibility).
  • Integrates with simplesamlphp/saml2, a battle-tested SAML library, reducing custom implementation risk.
  • Supports IdP (Identity Provider) core flows (SSO, SLO), covering 80% of enterprise SSO use cases.
  • Lightweight (~100 stars, niche but functional; no major dependents suggests low fragmentation risk).

• Cons:

  • Last release in 2018 → Potential deprecation risks with modern PHP/Laravel (e.g., PHP 8.x, Symfony 6+).
  • Limited SAML features (no advanced protocols like SAML 2.1, attribute mapping flexibility, or multi-IdP support).
  • GPL-3.0 license may conflict with proprietary Laravel projects (check legal compliance).
  • No Laravel-native integration → Requires Symfony bridge or custom adapters (e.g., symfony/console, symfony/dependency-injection).

Integration Feasibility

• Symfony ↔ Laravel Compatibility:
  • High for core HTTP/routing layers (e.g., symfony/http-kernel can proxy requests).
  • Medium for dependency injection (Laravel’s Service Container vs. Symfony’s DI Container).
  • Low for Symfony-specific components (e.g., SensioFrameworkExtraBundle).
• Key Dependencies:
  • simplesamlphp/saml2 (PHP 7.1+ compatible; may need polyfills for PHP 8.x).
  • symfony/framework-bundle (v3.x; may conflict with Laravel’s Symfony components).
• Workarounds:
  • Use Laravel’s Symfony Integration (e.g., laravel/symfony-bridge) for DI/routing.
  • Abstract SAML logic into a Laravel Service Provider to isolate Symfony dependencies.

Technical Risk

• Critical:
  • Stale maintenance → Risk of breaking changes with PHP 8.x or Symfony 6+.
  • License conflicts if using in closed-source projects.
• Moderate:
  • Custom adapter layer needed for Laravel’s request/response cycle (e.g., middleware for SAML assertions).
  • Testing effort for edge cases (e.g., malformed SAML responses, timeouts).
• Low:
  • Basic SSO/SLO flows are well-documented and stable.

Key Questions

1. Is PHP 8.x compatibility required? If yes, will simplesamlphp/saml2 need forks/patches?
2. What’s the SAML feature gap? (e.g., attribute mapping, multi-IdP, or SAML 2.1 support).
3. Can we isolate Symfony dependencies? (e.g., via a microservice or API layer).
4. How will we handle authentication state? (e.g., Laravel’s Auth vs. Symfony’s SecurityComponent).
5. What’s the fallback plan if this bundle is abandoned? (e.g., switch to onelogin/php-saml or shibboleth/sp).

Integration Approach

Stack Fit

• Laravel Compatibility:
  • Symfony Bridge: Use laravel/symfony-bridge to share components (e.g., DI, HTTP).
  • Middleware: Wrap SAML logic in Laravel middleware (e.g., SamlAuthMiddleware).
  • Service Providers: Register Symfony bundles as Laravel providers (e.g., Saml2BridgeServiceProvider).
• Alternatives:
  • Pure PHP SAML: onelogin/php-saml (more active, Laravel-friendly).
  • API Gateway: Offload SAML to a Symfony microservice (decouples Laravel from Symfony).

Migration Path

1. Phase 1: Proof of Concept
   • Install bundle in a Symfony sub-project (e.g., symfony-saml).
   • Test SAML flows (SSO/SLO) with a dummy SP (e.g., SimpleSAMLphp test SP).
2. Phase 2: Laravel Integration
   • Create a Laravel Service Provider to bootstrap Symfony bundles.
   • Implement custom middleware to handle SAML redirects/responses.
   • Example:

     // app/Providers/SamlServiceProvider.php
     public function register() {
         $this->app->register(SymfonyBridge::class);
         $this->app->boot(Saml2BridgeBundle::class);
     }
     

3. Phase 3: Authentication Sync
   • Map Symfony’s UserProvider to Laravel’s Auth system (e.g., via Auth::loginUsingId()).
   • Store SAML sessions in Laravel’s sessions table or a dedicated saml_sessions table.

Compatibility

• PHP Version: Tested on PHP 7.1–7.3; may need PHP 8.x polyfills (e.g., nikic/php-parser).
• Symfony Version: Bundles target Symfony 3.x; Symfony 5/6 components may need shimming.
• Laravel Version: Compatible with Laravel 7/8 via Symfony Bridge; Laravel 9+ may require updates.
• Database: No direct DB requirements, but custom tables may be needed for session storage.

Sequencing

1. Setup Symfony Environment:
   • Install symfony/framework-bundle and adactive-sas/saml2-bridge-bundle.
2. Configure SAML Metadata:
   • Define config.yml for IdP/SP entities (e.g., adactive_saml2_bridge config).
3. Laravel Proxy Layer:
   • Create middleware to route /saml/ to Symfony or handle assertions.
4. Authentication Flow:
   • Extend Laravel’s Auth to validate SAML responses.
5. Testing:
   • Validate with SAML test tools (e.g., SAML Tracer).
   • Test edge cases (e.g., expired sessions, malformed requests).

Operational Impact

Maintenance

• Pros:
  • Minimal ongoing work if SAML flows are stable (basic SSO/SLO).
  • Centralized config (Symfony’s config.yml for SAML settings).
• Cons:
  • No active maintenance → Risk of unpatched vulnerabilities in simplesamlphp/saml2.
  • Dependency bloat: Pulls in Symfony components (e.g., monolog, twig).
  • Debugging complexity: Symfony stack traces may obscure Laravel issues.

Support

• Community:
  • Limited: 11 stars, no open issues → Assume self-support.
  • Alternatives: Leverage onelogin/php-saml community or Symfony SAML forums.
• Vendor Lock-in:
  • Low: SAML is a standard, but custom adapters may tie you to this bundle.
• Monitoring:
  • Log SAML events via Symfony’s monolog (integrate with Laravel’s Log facade).
  • Track failures in saml2_bridge.log (custom log handler needed).

Scaling

• Performance:
  • Stateless: SAML assertions are HTTP-based; no persistent scaling bottlenecks.
  • Session Storage: If using DB-backed sessions, ensure Laravel’s database driver scales.
• Load Testing:
  • Simulate high SSO volume (e.g., 1000 RPs/sec) to test Symfony/Laravel handoff.
  • Monitor memory usage (Symfony’s DI container may add overhead).
• Horizontal Scaling:
  • Sticky sessions required for SAML state (e.g., Redis-based session storage).

Failure Modes

Ramp-Up

• Learning Curve:
  • Moderate: Requires familiarity with Symfony bundles, SAML protocols, and Laravel’s Auth system.
  • Resources:
    • Symfony SAML Bundle Docs (outdated).
    • [SimpleSAMLphp SAML Guide](https://