- What is karolornoch/php-saml used for?
- It is a simple PHP SAML toolkit for adding service-provider single sign-on to web applications. It handles generating AuthnRequests, validating signed SAML responses, and managing identity provider and service provider metadata and certificates. You use it when your application needs to act as a SAML SP against an IdP such as Okta, Azure AD, or ADFS. It is framework-agnostic PHP, so it works in plain PHP projects as well as inside Laravel.
- How do I install karolornoch/php-saml with Composer?
- Install it with composer require karolornoch/php-saml, which pulls the package from Packagist under that vendor and package name. Pin a released tag in production so authentication code does not shift underneath you. Because it is a library rather than a Laravel bundle, you can call it directly from a controller, middleware, or a dedicated service class.
- Can I use this SAML toolkit inside a Laravel application?
- Yes. It is plain PHP, so you can wrap it in a Laravel controller or a dedicated service class and expose a route such as /saml/login. Keep the SAML settings in config/services.php or a custom config file and resolve them through the container. Laravel's HTTP layer can handle the POST and Redirect binding endpoints while the toolkit builds and validates the SAML messages.
- How do I generate a SAML AuthnRequest for my service provider?
- Build the AuthnRequest from settings that describe your SP entity ID, assertion consumer service URL, and the identity provider's SSO endpoint. Then send the user's browser to the IdP using the HTTP-Redirect or HTTP-POST binding. After the IdP authenticates the user, it posts a SAML response back to your ACS endpoint for validation before you create a session.
- How does the package validate signed SAML responses?
- The toolkit parses the SAML response, verifies the XML signature against the configured IdP certificate, and checks conditions such as audience, recipient, and validity time windows. Only after those checks pass should you read the NameID and attributes to establish the user's session. Always validate before trusting any attribute, and treat every validation failure as an authentication failure rather than a warning.
- Where do I configure IdP and SP metadata and certificates?
- Settings are passed to the toolkit as an array covering your SP entity ID, ACS URL, and the IdP's entity ID, SSO endpoint, and X.509 signing certificate. Source those values from the IdP's metadata XML and store them in environment variables so certificates are not committed to source control. Rotate certificates by updating the configured values before the IdP's current certificate expires.
- Is karolornoch/php-saml safe to use in production?
- SAML security depends on strict signature validation, correct audience and recipient checks, and protection against XML signature wrapping, so review the validation path and keep the library updated. Serve your ACS and metadata endpoints over HTTPS only and reject unsigned or unexpected responses. Pin a specific Composer version and watch the repository for security fixes before relying on it for authentication.
- Which PHP and Laravel versions does this package support?
- The package overview does not list version constraints, so check the require section of its composer.json on Packagist for the supported PHP range. Laravel compatibility generally follows your PHP version because the toolkit is framework-agnostic and needs no service provider. Test the install against your application's PHP version before upgrading either one.
- How can I test SAML SSO locally without a real identity provider?
- Run a test IdP, or a mock that returns a signed SAML response using a certificate you control, to exercise your ACS endpoint locally. Keep test certificates and metadata in a separate non-production config so they never mix with live IdP settings. Write a feature test that posts a sample signed response to your ACS route and asserts the session is created, plus a negative test for a tampered signature.
- What are the alternatives to karolornoch/php-saml for Laravel?
- On the Laravel side, packages such as laravel-saml2 or Socialite-based SAML providers wrap SAML libraries and add ready-made routes, controllers, and configuration. Lower-level options include onelogin/php-saml, which many PHP SAML toolkits build on. Choose based on how much of the service-provider plumbing you want the package to own versus how much control you need over the raw SAML messages.