- Is korotovsky/sso-sp-bundle a Laravel package?
- No. It is a Symfony 2 bundle (SingleSignOnServiceProviderBundle) that registers through a Symfony kernel and dependency-injection extension and hooks the security firewall. The Laravel-style description appears aspirational, so inspect the repository itself rather than the README before planning Laravel work.
- Can I install korotovsky/sso-sp-bundle in a Laravel app with Composer?
- There is no realistic composer require and configure path for Laravel. Its Symfony 2 lifecycle constraints will collide with modern PHP 8 and Symfony 6-7 runtimes, and its auth integration is firewall and listener based, not Laravel guard and middleware based. Treat it as a reference specification, not a dependency.
- Does korotovsky/sso-sp-bundle support Laravel 10 or Laravel 11?
- The context provides no evidence of Laravel 10 or Laravel 11 support; it is a Symfony 2 bundle. Symfony 2 has been end-of-life since 2018, so expecting compatibility with current Laravel is unrealistic. Verify Composer constraints and source code before assuming any version support.
- What SAML toolkit does korotovsky/sso-sp-bundle use?
- The assessment does not identify the underlying SAML toolkit; the bundle is described as a thin orchestration shell. You must inspect composer.json and the source to see whether it wraps OneLogin php-saml, LightSAML, xmlseclibs, or another library. That library's health determines whether any protocol layer is salvageable.
- Is korotovsky/sso-sp-bundle actively maintained?
- The assessment reports zero stars, zero dependents, and no release cadence, which indicates no active upstream to absorb fixes. A single-maintainer, decade-stale bundle also has no evident CVE response path. Treat maintenance status as a blocking risk for production authentication.
- How does korotovsky/sso-sp-bundle handle SAML signature validation and replay protection?
- The assessment flags XML signature validation, assertion replay protection, and certificate handling as the critical unknowns. It does not confirm whether signatures are validated on the assertion, the response, or both, or whether Audience, Recipient, and InResponseTo are enforced. These questions must be answered by code review before any use in an auth path.
- Does korotovsky/sso-sp-bundle work with Azure AD, Okta, ADFS, or Shibboleth?
- The description claims support for external identity providers such as ADFS, Azure AD, Okta, and Shibboleth through standard SAML 2.0 service provider flows. However, claims in the description are not evidence of a working Laravel integration. Validate against your target identity provider only after confirming the artifact itself is viable.
- What are safer alternatives for SAML SSO in Laravel?
- First check whether your identity provider supports OIDC; a maintained Laravel OIDC or Socialite-style integration removes the XML signature risk class. If SAML is mandatory, terminate SAML at a maintained gateway such as Keycloak or Authentik and hand Laravel a clean OIDC token or trusted header. Build framework-native SAML only if those options are ruled out.
- Can I use korotovsky/sso-sp-bundle for IdP-initiated login and single logout?
- The description lists SP-initiated and IdP-initiated flows plus Single Logout support. That is useful as an acceptance-criteria checklist for your own service provider implementation. It is not proof that the Symfony 2 bundle will run correctly in a Laravel session and guard model.
- Is korotovsky/sso-sp-bundle safe for production Laravel authentication?
- The assessment rates technical risk as elevated and concentrated in the authentication path. A stale, single-maintainer bundle with no dependents has no community scrutiny of signature wrapping, XXE, unsigned-assertion acceptance, or certificate handling. Do not put it on a production Laravel auth path without a full security review and a maintained upstream.