Weave Code
Symfony Bridge Laravel Package
lightsaml/symfony-bridge
Symfony bridge for LightSAML that integrates SAML 2.0 service provider authentication with Symfony Security. Provides configuration, firewall integration, and user loading so Symfony apps can add SSO via existing SAML identity providers.
LightSAML Symfony Bridge Bundle
Frequently asked questions about Symfony Bridge
- What is lightsaml/symfony-bridge used for?
- It is a Symfony bundle that bridges the LightSAML library with Symfony Security for SAML 2.0 single sign-on. It registers LightSAML services in the Symfony container and provides configuration for service provider and identity provider metadata, signing certificates, firewall authentication, and attribute mapping. It is not a stand-alone SAML implementation; its behavior depends entirely on lightsaml/lightsaml.
- Can I use lightsaml/symfony-bridge in a Laravel application?
- No, this is a Symfony bundle built around Symfony's dependency injection container and security firewall, which Laravel does not provide in the same form. Laravel teams evaluating SAML should look at Laravel-specific packages or integrate LightSAML directly rather than assuming this bundle will install or work. The package is relevant to Laravel developers mainly as context when comparing PHP SAML options.
- How do I install lightsaml/symfony-bridge?
- The normal path is to require lightsaml/symfony-bridge with Composer, enable the bundle in the Symfony kernel or bundles.php, and configure your SP and IdP metadata, certificates, and firewall settings. However, on modern Symfony versions you should expect Composer constraint resolution to fail rather than a clean install. Budget for inspecting composer.json and potentially maintaining a fork before planning production use.
- Which Symfony and PHP versions does lightsaml/symfony-bridge support?
- The package historically targeted older Symfony releases, and version 1.3.0 does not announce dependency bumps or PHP 8 fixes. Its changelog only makes the ligthsaml.profile services public, which is a container visibility change rather than a platform support release. Do not assume Symfony 5, 6, or 7 compatibility or PHP 8.2+ support without checking the constraints and testing a fork.
- Does lightsaml/symfony-bridge support both SAML Service Provider and Identity Provider roles?
- Yes, the underlying LightSAML library models both Service Provider and Identity Provider roles, which is a meaningful differentiator from SP-centric alternatives such as hslavich/oneloginsaml-bundle on onelogin/php-saml. If your Symfony application must act as an IdP, this package may be one of very few in-process PHP options. If you only need to log users in through corporate Okta, Entra, or Azure AD as an SP, better-supported paths exist.
- Is lightsaml/symfony-bridge maintained and safe for production?
- Technical risk is high: the prior release was in 2018, version 1.3.0 is a single-line visibility fix, and there are zero Packagist dependents, no security policy, and no advisory history. SAML signature validation and XML parsing are security-critical areas exposed to signature wrapping, XXE, and assertion replay. The MIT license makes an internal fork legally clean, but you must budget for security review, dependency upgrades, and CVE response.
- Why does composer require lightsaml/symfony-bridge fail on Symfony 6 or PHP 8?
- Version 1.3.0 changes service visibility but does not widen composer.json constraints or announce PHP 8 fixes. PHP 8 also introduces hard breaks in the SAML stack, including removal of libxml_disable_entity_loader and XML canonicalization or signature handling issues in robrichards/xmlseclibs. Treat installation on modern Symfony or PHP as a fork-and-upgrade project, not a normal Composer install.
- What changed in lightsaml/symfony-bridge version 1.3.0?
- Version 1.3.0 is the first publication since 2018-05-23, and its entire changelog is one line: making the ligthsaml.profile.* profile services public. That is a container visibility fix that restores $container->get() access and enables service overriding in tests. It is not a platform-support release, and the transposed ligthsaml service name suggests the change was made quickly and lightly reviewed.
- What are alternatives to lightsaml/symfony-bridge for SAML SSO in Symfony?
- The mainstream maintained alternative is hslavich/oneloginsaml-bundle on top of onelogin/php-saml, but it is SP-centric. If you need Symfony to act as an Identity Provider, this bridge remains one of the few in-process PHP options despite its maintenance risk. Laravel teams should instead evaluate Laravel-specific SAML packages or a custom LightSAML integration.
- How do I test or override LightSAML services in Symfony with this bundle?
- Version 1.3.0 makes the ligthsaml.profile.* services public, so you can fetch them from the container and override them in tests more easily. You should still pin versions and add integration tests around metadata loading, signature validation, and attribute mapping. For production, include explicit checks for XML entity handling, assertion replay, and certificate rotation.
Weaver
How can I help you explore Laravel packages today?