Weave Code
Shibboleth Authentication Bundle Laravel Package
gauss-allianz/shibboleth-authentication-bundle
Symfony bundle that adds Shibboleth single sign-on authentication to your application, letting you integrate federated identity providers and protect routes with Shibboleth-based login.
Bundle for Shibboleth authentication in Symfony for Service Provider (SP) applications.
Frequently asked questions about Shibboleth Authentication Bundle
- Can I use gauss-allianz/shibboleth-authentication-bundle in a Laravel application?
- No. This is a Symfony bundle, not a Laravel package, and it cannot be dropped into a Laravel application. Its implementation is coupled to Symfony bundle, config, DI, and Security component conventions. For Laravel you should implement an equivalent auth guard plus middleware or adopt a native SAML package instead.
- How does this bundle authenticate users through Shibboleth?
- It reads Shibboleth Service Provider attributes injected by the web server, typically Apache mod_shib, maps them to a Symfony user, and hands off to Symfony's security firewall. The bundle does not perform SAML negotiation itself; the Shibboleth SP terminates federation and sets headers such as Shib-* or eppn and mail. That header-trust model is the core of its security design.
- Which Symfony and PHP versions does this bundle support?
- The repository metadata supplied does not confirm the declared Composer constraints, so check composer.json before installing. Symfony's security system changed materially across 4.x, 5.x, 6.x, and 7.x, and an unmaintained bundle pinned to an older major can blockade framework upgrades. Verify your target Symfony and PHP versions fall inside the bundle's constraints.
- How do I install and configure the bundle behind a Shibboleth SP?
- This only applies to Symfony applications. Install it through Composer, wire the bundle's firewall factory, and define the attribute-to-user mapping explicitly in configuration rather than accepting defaults. It requires a properly configured Shibboleth SP, either native mod_shib or a FastCGI or authorizer shim, and the application server must not be directly reachable.
- How are Shibboleth attributes mapped to Symfony users?
- The bundle's model is to map SP-injected attributes to a Symfony user, but the exact attribute names depend on your identity provider's release policy. Federations such as InCommon, DFN-AAI, UK Federation, eduGAIN, and corporate IdPs vary, so inspect the source to confirm which headers it trusts and how it resolves or creates users. Configure the mapping explicitly rather than relying on defaults.
- Is it safe to trust Shibboleth headers like eppn and mail in production?
- The entire security model rests on the SP headers being authoritative. Misconfiguration such as direct application exposure, proxy header passthrough, or load-balancer header rewriting can turn the bundle into an impersonation vector. Ensure the app server is never directly reachable and that headers are stripped at the edge, then have the auth path reviewed by security.
- How can I test Shibboleth authentication locally?
- Testing is awkward because the headers are normally injected by the Shibboleth SP rather than by the application. Simulate them at the web server or proxy layer rather than adding a production header-trust bypass. If you build a Laravel custom guard instead, test the middleware with faked server variables and assert that direct untrusted requests are rejected.
- Does this bundle support single logout and session termination?
- The supplied context does not confirm Single Logout support, and federation lifecycle duties remain regardless. Session termination across the SP and IdP is where these integrations typically break. Check the source for logout handling and plan for IdP-initiated logout before committing to the package.
- Is this package maintained, and what are the risks of using it?
- Zero stars, zero dependents, and an opportunity score of 28.96 signal an unvalidated, likely single-author artifact. The risks are high and concentrated in orphan maintenance, header-trust boundaries, Symfony framework drift, and federation lifecycle operations. A security-sensitive auth path is the worst place to be the only consumer of a dependency.
- What alternatives should a Laravel team consider for Shibboleth or SAML SSO?
- Do not attempt a bridge to this Symfony bundle. Either implement a thin, auditable Laravel guard and middleware that reads the same SP headers, or use a maintained SAML SP library and skip mod_shib entirely. The second option removes the Apache module but adds XML-signing and metadata-handling surface, so it is not automatically cheaper.
Weaver
How can I help you explore Laravel packages today?