Weave Code
Spid Laravel Laravel Package
italia/spid-laravel
A Laravel package for integrating SPID, Italy’s digital identity system, into your application. It provides ready-to-use authentication routes, middleware, and configuration so users can sign in securely with their SPID credentials.
SPID authentication package for Laravel
Frequently asked questions about Spid Laravel
- What is italia/spid-laravel used for?
- italia/spid-laravel is a Laravel package for integrating SPID, Italy's public digital identity system, into an application. It provides a service provider, publishable configuration, authentication routes, controllers, and middleware for SPID login and logout flows. It is a thin Laravel wrapper around the italia/spid-php SAML 2.0 library.
- How do I install and configure italia/spid-laravel in Laravel?
- Install it with Composer, register the package service provider if your Laravel version does not auto-discover it, and publish the configuration file. Then set environment variables for your entity ID, ACS and logout URLs, signing key and certificate paths, and identity provider metadata. The exact URLs and certificates must match your SPID registration for each environment.
- Which Laravel and PHP versions does italia/spid-laravel support?
- The package is intended for modern Laravel applications running PHP 8.x, and it depends on extensions such as openssl, dom, and libxml for SAML signing and XML handling. Check the Composer constraints in the package before adopting it, because exact Laravel version support can change between releases. Confirm your target Laravel release is inside the supported matrix.
- Does italia/spid-laravel integrate with Laravel's built-in authentication guard?
- Yes. The package fits Laravel's guard-based authentication model and provides a named auth guard plus a login controller that hands off to the SPID client. The main integration seam is the guard and user provider rather than the session or middleware stack. This means it does not force an application-wide architectural change, but it does change how users are identified.
- How do I configure SPID identity providers and test environments?
- Configuration is handled through Laravel config and environment variables, including identity provider selection and metadata. The package supports official SPID identity providers as well as test environments, which is useful during development and integration testing. Keep environment-specific entity IDs and callback URLs separate so test and production registrations do not collide.
- How does italia/spid-laravel handle SPID metadata and signing certificates?
- The package helps generate SPID metadata and configure signing and encryption certificates through the Laravel configuration. In practice, you should store private keys and certificates in a secret store rather than the repository. Certificate rotation and metadata refresh should be part of an operational runbook after launch.
- Can I use italia/spid-laravel for a stateless API-only Laravel backend?
- It is not a natural fit for stateless API-only backends because the SPID SAML flow is redirect- and session-centric. The package assumes server-side session authentication and a conventional user provider. You would need an adapter layer or a different architecture if your application has no session-based login flow.
- What is required to go live with SPID beyond installing italia/spid-laravel?
- You need a SPID Service Provider agreement with AgID, usually through an accredited aggregator such as InfoCert, TeamSystem, or Poste. You also need validated x509 signing certificates, published SP metadata, and registered ACS and logout URLs for each environment. Onboarding is typically an administrative and legal process that can take weeks to months, while the Laravel work itself is much shorter.
- How do I test SPID login flows locally with italia/spid-laravel?
- Use the SPID test identity providers and test environments supported by the package, and configure test-specific entity IDs, certificates, and callback URLs. Exercise the full SP-initiated login flow, assertion consumption, attribute mapping, and logout against the test IdP. Also test certificate and clock-skew failures, because those are common causes of opaque SAML errors.
- What are the risks or alternatives to using italia/spid-laravel?
- The main technical risks are SAML signature validation issues, certificate and metadata lifecycle problems, and compliance details such as attribute mapping and the official SPID login button and identity provider selection UX. The package has a small contributor base and depends on upstream libraries, so you may need to fork or vendor it if fixes are slow. Alternatives include using italia/spid-php directly, adopting an aggregator's SDK, or building custom SAML integration, especially if you also need CIE support.
Weaver
How can I help you explore Laravel packages today?