Ldap Bundle Laravel Package

Product Decisions This Supports

• Build vs. buy for enterprise auth — as a negative data point, not a candidate. The name promises LDAP, but the description ("Authorisation bundle fot gepur apps") and the -bundle suffix indicate this is a vendor-internal Symfony bundle written for Gepur's own applications, not a general-purpose LDAP integration. That makes it useful only as market intelligence: it confirms that mid-market e-commerce players with on-prem directories end up hand-rolling authorization glue rather than adopting an off-the-shelf package.
• Roadmap input on enterprise SSO demand. If your roadmap includes "support enterprise customers with Active Directory / LDAP," this package is a signal that the naive path (bind + group lookup + local role mapping) turns into bespoke, unmaintainable per-vendor code. That argues for a protocol-level investment (SAML/OIDC via an identity broker) over a directory-level one.
• Due-diligence checklist calibration. 1 star, 0 dependents, no release since April 2021, no public documentation, and a typo in the one-line description are a textbook "do not adopt" profile. Use it as a worked example when setting minimum bars for third-party dependency intake.
• Not a feature decision, a non-decision. There is no roadmap item, feature scope, or use case in a Laravel product that this package advances. Record it as evaluated-and-rejected so the same package isn't re-proposed in three months.

When to Consider This Package

Consider it only under all of the following:

• You are maintaining or integrating with Gepur's own codebase (or a fork of it) and need byte-compatible authorization semantics.
• You are on Symfony, not Laravel — the Bundle convention and service-container wiring do not map cleanly onto Laravel's service providers without a rewrite.
• You have access to Gepur's internal documentation and team, because none is public.
• You accept unpinned risk: no releases in 4+ years, no issue triage, no security response path, and a single maintainer.

Look elsewhere in essentially every other case:

• Laravel LDAP integration: ldaprecord-laravel or adldap2-laravel for directory reads, group resolution, and attribute sync against AD/OpenLDAP.
• Enterprise SSO (the decision most teams actually need): OIDC/SAML through Laravel Socialite, laravel/socialite providers, or a broker like WorkOS, Auth0, or Keycloak. This gets you Okta, Entra ID, and Google Workspace with a maintained support surface.
• Permission/authorization modeling: spatie/laravel-permission or Laravel Gates/Policies — keep authorization in your app, keep identity in the IdP. This package conflates the two, which is precisely the coupling you want to avoid.
• Any scenario where the vendor is not you: vendor-named bundles ("for gepur apps") are internal artifacts by construction. Zero dependents confirms nobody outside has validated it.

How to Pitch It (Stakeholders)

Executive summary: We evaluated gepur-it/ldap-bundle for enterprise directory / LDAP authentication. Recommendation: do not adopt. It is a single-vendor internal Symfony bundle published incidentally, with one star, zero downstream dependents, no release since April 2021, no public documentation, and a description that explicitly scopes it to "gepur apps." Adopting it would give us an unmaintained, undocumented, framework-mismatched dependency sitting directly on our authentication path — the highest-blast-radius place in the product.

To engineering: the underlying need is real — enterprise buyers will ask for AD/Entra ID login and group-based roles. The right shape is: identity via OIDC/SAML (broker or Socialite), authorization stays in Laravel Gates/Policies, directory attribute sync (if needed) via ldaprecord-laravel. Roughly the same effort as integrating this bundle, with a maintained supply chain and no Symfony-to-Laravel port.

Risk framing: the cost of this package is not the license (MIT, free) — it's the incident where an auth path breaks and there is no upstream to fix it. Authentication dependencies should be the most maintained things we ship, not the least.

Ask: approve closing this evaluation as rejected, and scope a spike on OIDC/SAML-based enterprise SSO if customer demand materializes.