- Does hslavich/simplesamlphp-bundle work with Laravel?
- No. It is a Symfony bundle that wires SimpleSAMLphp into Symfony's security listener and service container, so there is no Laravel service provider or auth guard. Laravel applications should use a maintained SAML package or terminate SAML at an out-of-process gateway and consume OIDC or trusted headers.
- Which Symfony and PHP versions does this SimpleSAMLphp bundle support?
- It targets the Symfony 2.8, 3.x and early 4.0 security model with PHP 5.6 through 7.x. It relies on SimplePreAuthenticatorInterface and AbstractPreAuthenticatedListener, which were deprecated in Symfony 4.0 and removed in 5.0. It is not compatible with Symfony 5.3+ authenticators or Symfony 6/7 without a fork.
- Is hslavich/simplesamlphp-bundle still maintained?
- No. The repository has gone more than eight years without a release, has roughly 22 stars and zero dependents. There is no advisory feed or maintainer SLA, and dependency scanners will keep flagging it. Treat it as abandoned unless you explicitly fork and own it.
- How do I install and configure simplesamlphp-bundle in Symfony?
- Historically you installed it with Composer, enabled the bundle in AppKernel, and configured SimpleSAMLphp as a sibling application with its own config/config.php, metadata and cert directories. The bundle expects SimpleSAMLphp to run in the same PHP process, cookie domain and hostname as Symfony. There is no Symfony config tree, env interpolation or secrets manager integration for SimpleSAMLphp settings.
- Can I use this bundle with SimpleSAMLphp 2.x?
- No, not without changes. The bundle references un-namespaced classes such as SimpleSAML_Auth_Simple and SimpleSAML_Configuration, which SimpleSAMLphp 2.x replaced with a namespaced API. A fork would need to update those references and re-test the Symfony security integration.
- How does the bundle handle SAML login and logout flows?
- It is a thin Symfony bridge over SimpleSAMLphp's own front controller. A pre-authentication listener drives Symfony security from the SimpleSAMLphp session, while login, logout and metadata endpoints are served by SimpleSAMLphp. This requires shared session storage and a shared cookie domain between the Symfony app and SimpleSAMLphp.
- What are the best alternatives to simplesamlphp-bundle for SAML in PHP?
- For Symfony, use a maintained in-process bundle such as nbgrp/saml-sp-bundle or write a small AbstractAuthenticator around onelogin/php-saml. Alternatively, run SimpleSAMLphp v2, Keycloak, Authelia or oauth2-proxy as an out-of-process gateway and hand Symfony an OIDC token or trusted header. Laravel teams should follow the same pattern with a maintained package or gateway.
- What are the security risks of using this bundle in production?
- SAML is a security-critical surface covering assertion signature validation, XML canonicalization, signature-wrapping defenses and XXE handling. This bundle is an unmaintained wrapper around whatever SimpleSAMLphp version it pins, potentially an end-of-life 1.x release. With no advisory feed and no downstream dependents, breakage or vulnerabilities may go unnoticed.
- How can I test SAML authentication with this bundle?
- It is difficult to unit test because the bundle reads SimpleSAMLphp configuration from disk and depends on its front controller and session. Realistic testing requires an integration environment with SimpleSAMLphp and a test identity provider. A maintained in-process library with a mock IdP is far easier to test.
- Does it support IdP-initiated login, single logout, encrypted assertions and attribute mapping?
- Those capabilities come from SimpleSAMLphp itself, not from the bundle, and must be configured in SimpleSAMLphp metadata and auth source config. The bundle mainly exposes auth sources to Symfony services and drives the pre-authentication listener. Attribute and group mapping into Symfony roles is custom code, and you must verify support for your specific flow and IdP requirements.