Oneloginsaml Bundle Laravel Package

Product Decisions This Supports

• Enterprise sales unblocking (SSO as a gate): SAML 2.0 support is a recurring procurement checkbox for mid-market and enterprise buyers. This bundle is the shortest path to a working Service Provider (SP) integration on a Symfony stack, so it directly informs the "can we close this deal this quarter?" conversation.
• Build vs. buy for auth: Choosing a maintained bundle over an in-house SAML implementation (XML signature validation, assertion parsing, clock skew, replay protection) is almost always the right call. The decision this package supports is which wrapper to standardize on, not whether to use SAML.
• Roadmap sequencing for "Enterprise Readiness": If SSO sits in a theme alongside SCIM provisioning, audit logs, and role mapping, this package lets you ship the SSO milestone cheaply and defer SCIM.
• Scope of IdP support: The bundle supports multiple identity providers and per-IdP configuration, which determines whether you can commit to "works with Okta, Entra ID, Google Workspace, and Ping" in a sales deck or must narrow that claim.
• Attribute/role mapping design: The bundle's attribute-mapping layer is where you decide how IdP groups become application roles — a product decision about admin experience (self-serve mapping UI vs. config-file only) that will drive support load.
• Platform assumption check: Note this is a Symfony bundle, not a Laravel package. If the roadmap assumes a Laravel codebase, this is not the artifact to evaluate — the equivalent decision is between aacotroneo/laravel-saml2, Socialite-based providers, or a hosted IdP-broker. Confirm the framework before anything else.

When to Consider This Package

Adopt when:

• The product is on Symfony (this bundle is explicitly Symfony-only and will not drop into Laravel).
• You need SP-initiated and/or IdP-initiated SAML 2.0 with assertion signature validation and want to delegate that to the mature onelogin/php-saml toolkit rather than hand-roll XML-DSig.
• You need multiple IdPs / per-tenant IdP configuration — a common B2B requirement where each customer brings their own IdP.
• You want attribute mapping into Symfony's security layer (users auto-provisioned from assertions) without building a custom user provider.
• You are comfortable pinning to a 2022-era release and owning the upgrade path yourself.

Look elsewhere when:

• Maintenance risk is unacceptable. Last release was 2022-11-23, the dependent count is effectively zero, and the opportunity signal is weak (31.33). Treat this as a thin, low-traffic wrapper — budget for forking or vendoring it if SSO becomes business-critical.
• The underlying toolkit's lifecycle is a concern. Verify the current support status of onelogin/php-saml before committing; if it is in maintenance/EOL, the whole dependency chain needs a migration plan (e.g., to a maintained SAML library or a hosted broker like WorkOS/Auth0/Okta).
• You need OIDC more than SAML. Most IdPs now prefer OIDC; if customers accept it, a simpler integration may cover 90% of deals.
• You want turnkey enterprise SSO without auth engineering. A hosted broker trades per-seat cost for eliminating the maintenance, certificate-rotation, and metadata-refresh burden entirely.
• You require first-class support/SLA — MIT community packages carry none.

PM diligence checklist before committing: confirm Symfony version compatibility (Symfony 5/6+), verify the underlying library's security-advisory history, check the repo's issue/PR responsiveness, and confirm whether certificate rotation and metadata refresh are handled or manual.

How to Pitch It (Stakeholders)

For executives: Enterprise buyers routinely require SAML single sign-on before signing. This MIT-licensed Symfony bundle gives us a proven, low-cost route to that checkbox — it wraps the widely used OneLogin SAML toolkit and handles the security-sensitive parts (signature validation, assertion parsing, attribute mapping) that we should not build ourselves. It lets us say "yes" to SSO in procurement without a multi-sprint auth project, and it supports multiple identity providers so one integration serves Okta, Entra ID, and Google Workspace customers. The caveat to fund: the package's last release was 2022 and its ecosystem activity is thin, so I recommend we treat it as a starting point and budget a small amount of ongoing ownership — dependency vetting, certificate rotation, and a fallback plan — rather than assuming it is a permanent foundation.

For engineering: This is a Symfony bundle, not a Laravel package — confirm stack fit first. It integrates onelogin/php-saml into Symfony's security firewall, giving us SP- and IdP-initiated flows plus attribute-to-user mapping. Before we adopt: validate Symfony version support, audit the transitive dependency's maintenance status, and scope who owns metadata/certificate refresh. If the underlying library is sunsetting, plan the abstraction boundary now so we can swap the SAML provider without touching product code.