Simplesamlphp Bundle Laravel Package

Technical Evaluation

Architecture Fit

• Symfony + SimpleSAMLphp Synergy: The package bridges Symfony’s dependency injection, routing, and templating with SimpleSAMLphp’s identity provider (IdP)/service provider (SP) capabilities, making it ideal for projects requiring SSO, federated authentication, or SAML-based identity management within a Symfony ecosystem.
• Modularity: Leverages Symfony’s bundle architecture, allowing for granular integration (e.g., only enabling IdP or SP functionality) without monolithic dependencies.
• Use Cases:
  • Enterprise SSO: Replace custom auth with SAML 2.0 for multi-domain or third-party integrations.
  • Legacy System Modernization: Integrate SimpleSAMLphp’s battle-tested SAML stack into a Symfony microservice or API gateway.
  • Compliance: Meet regulatory requirements (e.g., HIPAA, GDPR) via standardized SAML flows.

Integration Feasibility

• Symfony Compatibility: Officially supports Symfony 5.4+ (check for LTS alignment). Assess compatibility with your Symfony version (e.g., Flex recipes, autowiring).
• SimpleSAMLphp Dependencies: Pulls in SimpleSAMLphp (~2.0.x), which may require:
  • PHP 7.4+ (or 8.x for newer versions).
  • Extensions: openssl, mbstring, xml (critical for SAML parsing).
  • Database (if using SimpleSAMLphp’s user stores; alternatives like LDAP may reduce coupling).
• Configuration Overhead:
  • SAML Metadata: Requires XML metadata for IdPs/SPs (automated discovery via metadata or manual config).
  • Routing: Symfony routes must delegate to SimpleSAMLphp’s endpoints (e.g., /simplesaml/saml2/idp/metadata.php).
  • Templating: Customize SimpleSAMLphp’s themes via Symfony’s Twig integration (if enabled).

Technical Risk

• SAML Complexity: SAML misconfigurations (e.g., incorrect signing certificates, attribute mappings) can lead to authentication failures or security vulnerabilities. Validate with tools like SAML Tracer.
• Dependency Bloat: SimpleSAMLphp’s core (~10MB+) may increase deployment size. Consider Dockerizing or composer vendor patching to trim unused features.
• Symfony-Specific Quirks:
  • Event Dispatching: SimpleSAMLphp’s events (e.g., Core:AuthenticateSource:SUCCESS) may not align with Symfony’s event system. Use the bundle’s event listeners or bridge events manually.
  • Session Handling: Conflicts with Symfony’s session storage (e.g., Redis). Configure SimpleSAMLphp to use Symfony’s session handler or vice versa.
• Long-Term Maintenance:
  • SimpleSAMLphp has a smaller community than Symfony. Monitor for upstream deprecations (e.g., PHP 8.2+ support).
  • Bundle activity is low (0 stars/dependents). Validate with the maintainer (druidfi) on roadmap (e.g., Symfony 7.x, SAML 2.1).

Key Questions

1. Authentication Flow:
   • Will this replace Symfony’s security component entirely, or run in parallel (e.g., SAML as a secondary auth method)?
   • How will you handle user provisioning (e.g., syncing SAML attributes to Symfony’s User entity)?
2. Performance:
   • What’s the expected request volume for SAML assertions? SimpleSAMLphp may not scale horizontally out-of-the-box.
   • Are you using caching for metadata or session data?
3. Security:
   • How will you manage SAML signing keys (e.g., rotation, storage in Symfony’s ParameterBag or a secrets manager)?
   • Are you using HTTPS for all SAML endpoints (required for production)?
4. Monitoring:
   • How will you log/alert on SAML failures (e.g., expired tokens, malformed responses)?
   • Will you integrate with Symfony’s Monolog or use SimpleSAMLphp’s native logging?
5. Testing:
   • Do you have SAML test tools (e.g., PySAML2) to validate assertions?
   • How will you test edge cases (e.g., IdP downtime, clock skew)?

Integration Approach

Stack Fit

• Symfony Ecosystem:
  • Security Bundle: Can coexist but may require custom voters to handle SAML-authenticated users.
  • API Platform: Useful for exposing SAML-protected API endpoints (e.g., /api/saml-callback).
  • Mercure/UX: For real-time SAML event notifications (e.g., login status updates).
• Non-Symfony Dependencies:
  • SimpleSAMLphp Modules: Extend functionality (e.g., saml20-idp, saml20-sp) via Symfony’s config/packages/simplesamlphp.yaml.
  • Database: If using SimpleSAMLphp’s user store, ensure your DB schema supports its requirements (or use LDAP/AD).
  • Web Server: Ensure your server (Nginx/Apache) proxies SAML endpoints correctly (e.g., /simplesaml/ to the bundle’s public/ directory).

Migration Path

1. Proof of Concept (PoC):
   • Install the bundle in a staging environment:

     composer require druidfi/simplesamlphp-bundle
     

   • Configure simplesamlphp.yaml with a test IdP/SP (e.g., SimpleSAMLphp Demo).
   • Verify:
     • SAML login/logout flows.
     • Attribute mapping to Symfony’s user provider.
2. Incremental Rollout:
   • Phase 1: Integrate SAML SP for third-party auth (e.g., Okta, Azure AD).
   • Phase 2: Replace internal auth with SAML IdP for federated logins.
   • Phase 3: Extend to API gateways or microservices.
3. Backward Compatibility:
   • Maintain legacy auth (e.g., Symfony’s form_login) alongside SAML during transition.
   • Use feature flags to toggle SAML requirements per route.

Compatibility

• Symfony Versions:
  • Test with your exact Symfony version (e.g., 6.3.x). Check for breaking changes in:
    • Dependency injection (e.g., autoconfigure attributes).
    • HTTP client (e.g., Symfony 6+ uses Psr\Http\Client).
• PHP Extensions:
  • Enable required extensions in php.ini:

    extension=openssl
    extension=mbstring
    

• SimpleSAMLphp Configuration:
  • Merge Symfony’s parameters with SimpleSAMLphp’s config.php (e.g., datastore.type → sql:mysql://user:pass@host/db).
  • Example simplesamlphp.yaml:

    simplesamlphp:
        auth:
            default: saml20-idp
        sp:
            entity_id: "https://your-sp.example.com/saml2/idp/metadata"
            assertive: true
        idp:
            entity_id: "https://your-idp.example.com/saml2/sp/metadata"
    

• Database:
  • If using SQL storage, ensure your DB supports SimpleSAMLphp’s schema (or use a read-only store for metadata).

Sequencing

1. Pre-Integration:
   • Audit existing auth flows (e.g., Firebase Auth, OAuth2) for conflicts.
   • Set up SAML metadata for your IdP/SP (generate via metadata.php endpoints).
2. Bundle Installation:
   • Install the bundle and dependencies.
   • Configure Symfony’s security.yaml to delegate SAML routes:

     security:
         access_control:
             - { path: ^/simplesaml, roles: PUBLIC_ACCESS }
     

3. Core Integration:
   • Configure SAML attributes to map to Symfony’s User entity (e.g., mail → email).
   • Implement a custom user provider to hydrate users from SAML assertions.
4. Testing:
   • Test with mock IdPs/SPs (e.g., SAML Test Tool).
   • Validate CSRF protection and CORS for SP-initiated flows.
5. Production Rollout:
   • Deploy with feature flags for gradual enablement.
   • Monitor SAML logs and Symfony profiler for errors.

Operational Impact

Maintenance

• Bundle Updates:
  • Monitor for updates to druidfi/simplesamlphp-bundle and SimpleSAMLphp.
  • Pin versions in composer.json to avoid surprises: