Weave Code
Laravel Samlidp Laravel Package
codegreencreative/laravel-samlidp
A Laravel package that turns your app into a SAML Identity Provider (IdP), with SSO endpoints, service provider management, metadata, and certificate handling so Laravel can authenticate users for external SAML service providers.
Laravel SAML IdP
Frequently asked questions about Laravel Samlidp
- Is codegreencreative/laravel-samlidp a SAML Identity Provider or a Service Provider package?
- It is an Identity Provider package. It makes your Laravel application the party that authenticates users and asserts their identity to external SAML Service Providers. If your goal is to let users sign in to your app with Okta, Entra ID or another corporate IdP, you need a Service Provider package instead, so this one should be ruled out early.
- How do I install and configure laravel-samlidp in a Laravel application?
- Install it with Composer, publish the package config, and register the Service Providers you want to federate with. The package ships routes and controllers for the metadata, SSO and SLO endpoints, so it slots into your existing auth guards and middleware rather than requiring a parallel auth stack. Expect a few hours to get configured and a few days to prove a real end-to-end SSO flow against one SP.
- Which Laravel and PHP versions does laravel-samlidp support?
- Version 5.4.0 was released specifically to add Laravel 13.x compatibility as a minor bump from 5.3.2, with no API, feature or protocol changes. Check the exact PHP and Laravel constraints in v5.4.0's composer.json before upgrading, and confirm it does not drop a version you currently run. Staying on the 5.3.x line means carrying framework-upgrade debt rather than package-upgrade debt.
- Does laravel-samlidp support IdP-initiated SSO and Single Logout?
- The package provides SSO and SLO endpoints alongside metadata, but you must verify which SAML profiles are actually covered for your Service Providers. SP-initiated flows are the common baseline, while IdP-initiated support and SLO reliability vary by SP and by the underlying SAML library. Test logout explicitly in your own environment before relying on it in production.
- How do I register service providers and expose SAML metadata with laravel-samlidp?
- Service Providers are managed through a registry in the package, and metadata is served from a package route and controller that you point SPs at. Each SP typically needs its entity ID, ACS URL, and its own attribute and NameID contract. Treat the per-SP attribute mapping as a deliberate configuration step rather than accepting defaults.
- How does laravel-samlidp handle signing certificates and key rotation?
- Certificates are supplied through package configuration and file paths, so the real operational question is where the key material lives and who can rotate it. Plan for zero-downtime rotation by publishing multiple certificates in metadata during a rollover window. Store private keys outside the repository, ideally in a secrets manager, and rehearse the rotation before you actually need it.
- Which SAML library does laravel-samlidp use under the hood, and is it secure?
- The package delegates XML signing, signature verification and binding handling to an underlying SAML library, so that library's maintenance status and CVE history matter more than this package's release notes. Confirm which library and version v5.4.0 pins, and whether the 5.4.0 change touched anything beyond framework version constraints. Explicitly verify that signature verification cannot be disabled, that XML parsing resists XXE and signature-wrapping attacks, and that replay and NotBefore/NotOnOrAfter windows are enforced.
- Can laravel-samlidp let my users log in with Okta, Azure AD or Google?
- No. That is the Service Provider direction of SAML, and this package implements the Identity Provider side only. For corporate or social IdP login in Laravel, use a Service Provider package such as a SAML SP library or Laravel Socialite. Reaching for laravel-samlidp for that requirement is the wrong side of the protocol.
- How should I test a SAML IdP built with laravel-samlidp before going live?
- Test against at least one real Service Provider your customers actually use, not just a mock, because interop issues are where most of the effort lands. Verify assertion signatures, audience and recipient restrictions, replay protection and clock-skew handling. Also inspect the package's own CI matrix to see whether Laravel 13 is genuinely exercised or compatibility was only asserted without a matrix entry.
- Is laravel-samlidp maintained well enough for a security-critical authentication path?
- The v5.4.0 release shows the maintainer is keeping pace with Laravel's annual major cadence, which is a healthy maintenance signal. But it is a small-maintainer package sitting directly on the login path, where a defect means lockout or worse, an authentication bypass, so treat maintainer concentration as a real bus-factor risk. Pin versions, monitor the underlying SAML library's advisories, and keep a rollback and key-rotation plan ready.
Weaver
How can I help you explore Laravel packages today?