Weave Code
Sp Bundle Laravel Package
lightsaml2/sp-bundle
Symfony bundle integrating LightSAML so your application acts as a SAML 2.0 service provider. Provides DI services, configuration, and routing to handle authn requests, assertions, and metadata exchange with identity providers.
SAML2 SP Symfony Bundle based on LightSAML
Frequently asked questions about Sp Bundle
- Can I install lightsaml2/sp-bundle in a Laravel application?
- Not directly. lightsaml2/sp-bundle is a Symfony bundle built around Symfony's HttpKernel, dependency injection container, bundle bootstrapping, and configuration tree, none of which exist in Laravel. Composer may resolve the package, but booting it inside an Illuminate application will fail because it expects a Symfony kernel. The reusable asset is the framework-agnostic LightSAML core engine underneath it, not the Symfony wrapper itself.
- Does lightsaml2/sp-bundle support Laravel 11 and PHP 8.x?
- There is no Laravel support at all, since Laravel has no bundle concept and uses service providers, facades, and middleware instead. PHP 8.x compatibility is unverified, and Symfony 6/7 support is also unverified, which erodes even its value as a reference implementation. If you need a Laravel package, plan to audit the pinned LightSAML core version and its transitive dependencies yourself.
- How do I add SAML 2.0 SSO to Laravel using LightSAML?
- Wire the LightSAML core engine directly into a Laravel service provider and keep the integration thin. Add a config/saml.php file for IdP metadata, certificates, and SP entity details, then register routes for login, ACS, metadata, and logout plus middleware for assertion validation. On a successful assertion, call Auth::login() against your existing user provider. This typically amounts to a few hundred lines and avoids pulling Symfony kernel and DI constraints into your stack.
- Is lightsaml2/sp-bundle maintained and safe for production?
- Adoption signals are near-zero: one star, zero dependents, and a composite score of 0.035. SAML2 service provider code is a security-critical surface covering XML-DSig signature validation, canonicalization, assertion replay protection, and certificate handling, so a low-adoption wrapper with a checkered maintenance lineage is a real supply-chain and patch-latency risk. MIT licensing is the one clear positive. Before relying on it in any form, confirm who maintains it, what the release cadence is, and whether a security-disclosure contact exists.
- What are good alternatives to lightsaml2/sp-bundle for Laravel SAML SSO?
- Look at Laravel-native packages that wrap LightSAML core or php-saml through a service provider, config file, and middleware rather than a Symfony bundle. Evaluate them on maintained release cadence, PHP 8.x support, signed metadata generation, single logout, multi-IdP configuration, and a documented security contact. Running a two-week spike that benchmarks a native package against a hand-rolled LightSAML integration is the pragmatic way to choose.
- Which SAML profiles does lightsaml2/sp-bundle support?
- SP-initiated SSO is the core flow the bundle targets through authn requests, assertions, and metadata exchange. Single logout and IdP-initiated SSO are not clearly documented, so verify them against the source before assuming coverage. Also confirm signed metadata generation, key and certificate rotation, and multi-IdP configuration, since these are common enterprise requirements.
- Can I fork lightsaml2/sp-bundle into a Laravel package?
- Yes, but treat it as a small internal project rather than a drop-in replacement. The most valuable artifacts are services.yml and Configuration.php, which serve as a blueprint for the service graph, plus the assertion-handling and metadata logic. Reimplement the SP flow using Laravel idioms such as a service provider, config/saml.php, ACS and metadata routes, middleware, and Auth::login() instead of shoehorning the Symfony wrapper into Laravel.
- How do I handle SAML assertions and the ACS endpoint in Laravel?
- Register an ACS route that accepts the IdP's POST and process the response with LightSAML, validating the XML signature against the configured IdP certificate. Check audience, recipient, NotBefore and NotOnOrAfter conditions, and enforce replay protection by tracking assertion IDs. Only after those checks pass should you map the NameID or attributes to a local user and call Auth::login(). Keep the validation logic in a dedicated service class so it is easy to test.
- How do I test SAML SSO in a Laravel application?
- Use a mock identity provider that issues signed assertions with test certificates so you can feature-test the ACS route without a live IdP. Cover failure cases explicitly: expired assertions, wrong audience, tampered signatures, and replayed assertion IDs. Finish with an end-to-end check against the real identity providers you support, such as Okta, Microsoft Entra, or Google Workspace, since their metadata and binding quirks often differ.
- Does lightsaml2/sp-bundle handle certificate rotation and multi-IdP setups?
- That is not clearly documented, and the bundle's configuration schema is the only reliable place to confirm it. Certificate rotation and multiple IdP configurations are standard enterprise requirements, so verify them early if you are using the bundle as a reference. When building the Laravel-native equivalent, design config/saml.php to accept a list of IdPs and multiple signing keys per IdP from the start, because retrofitting rotation later is painful.
Weaver
How can I help you explore Laravel packages today?