Weave Code
Sp Bundle Laravel Package
lightsaml/sp-bundle
Symfony bundle that adds SAML 2.0 Service Provider support via LightSAML. Configure SSO login/logout, consume IdP metadata, and validate assertions with minimal setup—ideal for adding enterprise single sign-on to Symfony applications.
SAML2 SP Symfony Bundle based on LightSAML
Frequently asked questions about Sp Bundle
- Can I install lightsaml/sp-bundle in a Laravel application?
- No. lightsaml/sp-bundle is a Symfony bundle that depends on Symfony's DI container, FrameworkBundle config tree, EventDispatcher, HttpKernel request/response cycle, and Symfony routing for its ACS and metadata endpoints. Laravel has analogous primitives, but they are not interchangeable, and the bundle has no Laravel service provider or bootstrapping contract. The only realistic option is to use the lightsaml/lightsaml core library and build a Laravel adapter around it.
- Does lightsaml/sp-bundle support Laravel 10 or 11 and PHP 8?
- No. As published, the bundle targets PHP 7.1+ with Symfony 3.4/4.x, while Laravel 9+ requires PHP 8.0+ and Laravel 10/11 require PHP 8.1/8.2. The last release was 2019-11-13, and the code predates PHP 8 behavior changes. Installing it into a modern Laravel app is not a supported path.
- Does --ignore-platform-reqs make lightsaml/sp-bundle work on PHP 8?
- No. Bypassing Composer's platform checks only gets the package installed; the 2019-era Symfony code paths still assume PHP 7.x behavior and removed or changed features. In practice you should expect fatal errors or persistent deprecation noise. --ignore-platform-reqs does not make the bundle compatible at runtime.
- What is the difference between lightsaml/sp-bundle and lightsaml/lightsaml?
- lightsaml/lightsaml is the underlying framework-neutral SAML library that handles AuthnRequest generation, Response and Assertion validation, and metadata parsing. lightsaml/sp-bundle is the Symfony integration layer that wires that library into Symfony's container, config, events, and routes. For Laravel, the core library is the only realistic leverage point; you must re-implement the SP orchestration in Laravel-native services.
- How do I implement SAML 2.0 Service Provider SSO in Laravel?
- The practical shape is a framework-neutral SAML library, a thin Laravel adapter with a service provider, config file, auth guard, and middleware, and your own routes for ACS, metadata, and login initiation. Budget roughly two to four dev-weeks of well-scoped work regardless of which library sits underneath. Choose the library based on maintenance posture, not bundle convenience, and decide build versus buy before writing code.
- Is lightsaml/sp-bundle maintained and safe for production authentication?
- No. The last release was 2019-11-13, it targets PHP 7.1+ and Symfony 3.4/4.x, and it has about 64 stars with 0 dependents, so there is no community to catch regressions. SAML SP code is the highest-trust surface in an authentication flow, and an unmaintained validator means no patches for signature-wrapping, XML entity expansion, or assertion-replay vulnerabilities. A proof of concept against one IdP may work, but that validates the happy path and hides the maintenance liability.
- What SAML features does lightsaml/sp-bundle provide?
- The bundle provides SP-initiated SSO with configurable IdPs, metadata generation and consumption, support for signed and encrypted assertions, flexible attribute mapping to Symfony users, and YAML-based configuration. It does not guarantee coverage for IdP-initiated SSO, Single Logout, or multi-tenant per-customer metadata, which are common failure points in older SAML libraries. Confirm those requirements before evaluating it.
- How do I migrate from lightsaml/sp-bundle to a Laravel-native SAML integration?
- The portable parts are configuration: SP entity ID, ACS URL, signing and decryption certificates and keys, IdP metadata XML or URL, and attribute mapping. Any code that touched the bundle's services or Symfony event hooks must be rewritten; assume a lift-and-rewrite of the integration layer while preserving the SAML config values. Because the bundle has 0 dependents, confirm first whether anything is actually running on it.
- What are the best alternatives to lightsaml/sp-bundle for Laravel SAML SSO?
- Evaluate framework-agnostic options such as SAML-Toolkits/php-saml from the actively maintained OneLogin lineage. Alternatively, use a managed IdP broker like Auth0, WorkOS, or Okta as the SAML terminator and connect to Laravel over OIDC. Both avoid adopting a 2019-frozen SAML validator at your authentication boundary.
- What should I check before choosing a SAML SP package for Laravel?
- Clarify whether you need SP-initiated only or also IdP-initiated SSO, Single Logout, encrypted assertions, and signed metadata; SLO is where stale libraries usually fail. Determine whether you have a single-tenant IdP or multi-tenant per-customer metadata, since the latter is a much larger build. Also assess your internal SAML competence and whether you are willing to own a fork, because thin expertise plus unmaintained code is a trap.
Weaver
How can I help you explore Laravel packages today?