- Is jonathonwalz/shibboleth-bundle compatible with Laravel?
- No. It is a Symfony2 bundle that depends on Symfony's bundle registry, container compiler passes, and Symfony2 security layer, none of which exist in Laravel. Composer installation will fail against Laravel 10 or 11 and PHP 8.1+ because of its Symfony2-era and PHP 5.x/7.0 constraints. Treat it as a reference for Shibboleth attribute handling rather than an installable Laravel package.
- Can I install the ShibbolethBundle in a Laravel 10 or 11 application?
- Composer resolution will fail because the package targets Symfony2, which reached end of life in November 2019. There is no adapter layer that makes it usable inside Laravel's service container or security stack. For a Laravel target, implement a small guard and middleware instead of trying to install this bundle.
- How do I add Shibboleth SSO to a Laravel application?
- Run mod_shib or a Shibboleth-aware reverse proxy in front of Laravel and trust the SP-injected attributes such as Shib-Identity-Provider, eppn, mail, displayName, affiliation, and persistent-id. Write a custom guard and middleware that resolve or provision a local user and then issue a normal Laravel session. Keep SAML handling entirely out of PHP and ensure only the service provider can reach the application origin.
- Which Shibboleth attributes should I map to Laravel user fields?
- Typical mappings use eppn or persistent-id as the authoritative identifier, mail for email, displayName for name, affiliation for roles, and Shib-Identity-Provider for the issuing IdP. Choose eppn versus persistent-id based on your account-linking and de-provisioning requirements, because pseudonymous identifiers change that design. Confirm the actual attribute set released by your IdP rather than relying on federation documentation.
- How does Shibboleth logout work with Laravel?
- Shibboleth Single Logout is routinely out of scope, so the local Laravel session and the upstream IdP session may not end together. Clear the Laravel session and redirect to the SP logout endpoint if one is configured. The business must explicitly accept any remaining UX gap where the IdP session persists.
- What are alternatives to the ShibbolethBundle for Laravel?
- Use a guard-based integration with mod_shib or a Shibboleth-aware reverse proxy, which is the closest analogue to what the bundle does. If your hosting cannot provide an Apache module or proxy, use a pure-PHP SAML2 library such as SimpleSAMLphp or a maintained Laravel SAML2 package. The guard approach keeps application code small and auditable, while pure PHP has higher cost and more moving parts.
- Does jonathonwalz/shibboleth-bundle support PHP 8 and modern Laravel?
- No. The package has Symfony2-era dependencies and PHP 5.x/7.0 constraints, with no release cadence and a single author. For an authentication surface, an unmaintained upstream is disqualifying regardless of code quality. There is also no security advisory channel for the project.
- How can I test Shibboleth authentication in a Laravel application?
- In tests, simulate SP headers by setting server variables or headers on test requests, but gate header trust behind environment configuration. Assert that the guard resolves or provisions a user, maps attributes correctly, and rejects missing or invalid identifiers. Also test that direct requests to the origin cannot forge eppn, and complete a staging integration test with the real IdP metadata exchange.
- Is header-based Shibboleth authentication safe in production?
- Only if the service provider sits in front of every request and the application origin is unreachable directly. A misconfigured load balancer, container ingress, or debug route lets a client forge eppn and impersonate a user. Enforce a trusted-proxy check, strict network policy, and monitoring for direct-to-origin paths.
- Is jonathonwalz/shibboleth-bundle still maintained?
- There is no evidence of active maintenance: it is a single-author Symfony2 bundle with no release cadence and an end-of-life framework branch. It has zero dependents and no security advisory channel. Use it as a requirements checklist for a small in-house Laravel implementation rather than as a production dependency.