- Is hslavich/oneloginsaml-bundle a Laravel package?
- No. It is a Symfony bundle that wraps the OneLogin PHP SAML toolkit and ships Symfony-specific DependencyInjection extensions, a security firewall factory, and event subscribers. It has no Laravel service provider, guard, or configuration model, so it should be evaluated as a Symfony component rather than a Laravel package.
- Can I use this bundle in a Laravel application?
- Not as a drop-in dependency. The bundle's guard authenticator, security.yaml config tree, and user-creation subscribers are bound to Symfony's security model and do not map onto Laravel's guards, providers, or middleware. Realistic options are running it as a separate Symfony SAML broker, porting its flow into a Laravel package, or replacing it with a Laravel-native SAML service provider.
- How do I install and configure OneLoginSamlBundle?
- You install it with Composer and register the bundle in a Symfony kernel, then define a SAML firewall in config/packages/security.yaml with the IdP and SP metadata settings. Attribute mapping and just-in-time user creation are handled by event subscribers configured through the bundle's config tree. Because the setup depends on Symfony's security bundle, that configuration does not carry over to Laravel.
- Which Laravel versions does this package support?
- None. The package targets Symfony and PHP version ranges, and its Composer constraints are driven by Symfony components and onelogin/php-saml rather than by Laravel or illuminate/* packages. If you host it as a broker service, your Symfony and PHP versions set the platform ceiling, not your Laravel version.
- What are the best Laravel alternatives to this Symfony SAML bundle?
- Common choices are aacotroneo/laravel-saml2, a Socialite SAML provider, or using onelogin/php-saml directly behind a thin Laravel controller and middleware. These keep SAML handling inside Laravel's guard and user provider model and avoid running an extra Symfony service. Evaluate maintenance status and patched php-saml versions for whichever option you pick.
- Is hslavich/oneloginsaml-bundle still maintained?
- The last release was in November 2022 and adoption is thin, with roughly 147 GitHub stars and no dependents. SAML is a security-critical surface with a history of XXE, XML signature wrapping, and comment-truncation issues, so an unpatched dependency window becomes a finding in a security review. Confirm patch status for onelogin/php-saml and the SAML-Toolkit/php-saml successor before committing.
- How does this bundle map SAML attributes to users and roles?
- The bundle uses event subscribers to intercept the SAML response, map assertion attributes onto a user object, and optionally create users just in time. Attribute names and mapping rules are configured through the bundle's config tree rather than hard-coded. In Laravel you would reimplement that as a user provider plus a listener on the ACS response.
- Does this bundle support IdP-initiated SSO and Single Logout?
- It supports SP-initiated and IdP-initiated flows through the OneLogin toolkit, and the Symfony firewall exposes ACS and metadata endpoints. Single Logout support depends on the underlying php-saml version and how you configure the firewall, so verify SLO behavior end-to-end against your IdP. Multi-tenant per-customer IdP metadata is not a first-class feature; the bundle is oriented around a single IdP configuration.
- What is the broker pattern for using this bundle with a Laravel app?
- You run a small Symfony service that uses the bundle as a SAML service provider, complete the assertion exchange there, and issue a signed JWT or short-lived token. Laravel then authenticates that token through a custom guard or middleware. This keeps SAML parsing and certificates out of the Laravel request path and lets the bundle run in its native framework.
- How do I test SAML SSO with this bundle locally?
- Stand up a throwaway Symfony container against a test identity provider such as Keycloak or SimpleSAMLphp and exercise metadata exchange, attribute mapping, and logout end-to-end. Validate signed assertions, audience, recipient, and InResponseTo checks before trusting the flow. This evaluation harness also tells you whether the effort is better spent on a Laravel-native SP.