- What is kidatsy/lightsaml-lightsaml used for?
- It is a PHP LightSAML fork that provides a low-level SAML 2.0 toolkit for building service providers and identity providers. It can construct, sign, validate, and process SAML messages such as AuthnRequest, Response, and Assertion. In Laravel it would sit behind your own SAML adapter rather than replacing Laravel authentication.
- Does this package work with Laravel out of the box?
- No. It is a general-purpose PHP library, not a Laravel-native package, so it does not provide guards, middleware, routes, config publishing, user provisioning, or metadata endpoints. You must build the Laravel integration layer, including ACS and metadata routes, assertion validation, attribute mapping, certificate management, and session/auth mapping.
- How do I install kidatsy/lightsaml-lightsaml with Composer?
- Install it as a Composer dependency in your Laravel project and verify PHP and extension compatibility first. Because the package is a fork with a 2017 release, lock the exact version and test dependency resolution against your Laravel version. Keep it isolated in a service class or adapter instead of calling it directly from controllers.
- Is this LightSAML fork safe for production SAML SSO?
- Treat it as high risk unless you complete a security review and fund ongoing maintenance. SAML is security-sensitive, and the package has weak health signals: no dependents, no visible active maintainer community, and no release since 2017. For new production SSO, prefer a maintained SAML library, a maintained Laravel SAML package, or a managed identity provider.
- Which SAML flows can I implement with this library?
- It supports the core SAML 2.0 message model, XML signing and validation with X.509 certificates, and pluggable HTTP-Redirect, HTTP-POST, and SOAP bindings. You can use it for SP-initiated or IdP-initiated flows, but you must implement flow handling, routes, session behavior, and attribute mapping yourself. Confirm logout, encrypted assertions, and signed metadata requirements during a technical spike.
- What PHP versions and extensions does kidatsy/lightsaml-lightsaml require?
- The provided context does not list exact PHP constraints, and the last release was in 2017, so modern PHP compatibility must be verified before planning. Check Composer constraints and required extensions such as dom, libxml, and openssl in your target environment. Also test XML canonicalization, SHA-256 support, and compatibility with your Laravel version.
- How should I integrate SAML authentication into Laravel using this package?
- Wrap the library in an internal SamlProvider interface and keep protocol handling isolated from Laravel auth, user models, and business logic. Add Laravel routes for metadata and the assertion consumer service, then validate assertions and map attributes to users only inside your adapter. This makes it possible to replace the library later without rewriting controllers or business code.
- Does this package provide metadata endpoints, user provisioning, or Laravel guards?
- No. It is a protocol toolkit, not an authentication framework, so metadata endpoints, user provisioning, guards, middleware, and config publishing are application responsibilities. You need to generate and manage IdP/SP metadata, certificate rotation, attribute mappings, and session handling yourself. Budget for building and testing those pieces.
- How do I test a Laravel SAML integration built on this library?
- Test against your actual IdP and at least one test IdP, covering metadata, login, ACS validation, logout, and attribute mapping. Add automated tests for signature failure, expired certificates, clock skew, malformed assertions, and encrypted assertions if required. Run a time-boxed spike before committing because the package has no recent releases or community support.
- What are the alternatives to kidatsy/lightsaml-lightsaml for Laravel SAML SSO?
- Prefer a maintained SAML library, a maintained Laravel SAML package, or a managed identity provider for new production SSO. If you already use this fork, contain it behind an adapter, vendor the source, lock the version, add regression tests, and document a migration path. Use this package only as a short-term bridge, reference implementation, or migration aid.