Weave Code
Lightsaml Laravel Package
litesaml/lightsaml
Lite Saml is a low-level SAML 2.0 library for PHP: data model classes, XML serialization, security and certificate support, and message bindings to build SP and IdP integrations.
At a glance
Frequently asked questions about Lightsaml
- What is litesaml/lightsaml and what does it actually do?
- LiteSAML is a low-level, framework-agnostic PHP library that implements the SAML 2.0 data model. It gives you typed classes for messages such as AuthnRequest, Response, Assertion and Metadata, plus XML serialization and deserialization. It also handles XML security (signing, verification and encryption), X.509 certificate credential stores, and message encapsulation for the HTTP-Redirect and HTTP-POST bindings. It is a protocol codec and component, not a ready-made SSO product.
- Does litesaml/lightsaml work with Laravel?
- Yes, but not as a drop-in Laravel package. Since the Pimple container bridge and symfony/http-foundation dependency were dropped in favor of PSR-7 interfaces, the library is framework-agnostic and works fine inside a Laravel app, especially since Guzzle PSR-7 is already present in most Laravel dependency trees. What you do not get is Laravel glue: you write the controllers yourself for reading POST bodies, building redirects, persisting SAML state in the session, and mapping SAML errors to HTTP responses. There is no service provider, config file or facade shipped with the package.
- What PHP version does LiteSAML require?
- LiteSAML 5.0.0 and later require PHP 8.4 as a minimum, and that line also introduced strict typing and PHPStan level 6 analysis. If your Laravel estate is pinned to PHP 8.2 or 8.3, adopting this package means a platform upgrade rather than a simple composer require. Check your runtime target before you commit to it, because there is no maintained 8.1/8.2-compatible branch for the current feature line.
- How do I install litesaml/lightsaml with Composer?
- Run composer require litesaml/lightsaml and confirm your PHP binary is 8.4 or newer. The package is MIT licensed, has a small dependency footprint, and pulls in robrichards/xmlseclibs for XML digital signature and encryption work. Pin an exact or tightly constrained version in composer.json, because security fixes in a SAML library are releases you want to control deliberately rather than absorb silently.
- What is the difference between litesaml/lightsaml and litesaml/saml?
- litesaml/lightsaml is the low-level foundation: data model classes, XML (de)serialization, XML security, certificate handling and binding message encapsulation. litesaml/saml is the higher-level wrapper built on top of it, providing ready-to-use ServiceProviderWrapper and IdentityProviderWrapper classes that handle the SP and IdP flows. The package README explicitly points to the wrapper if you want to integrate SAML without dealing with the data model directly. Choose this package when you need control over the protocol layer or are building an IdP or broker.
- Does LiteSAML handle XML signing, encryption and certificates?
- Yes. XML digital signatures, verification and encryption are handled through robrichards/xmlseclibs, and the library ships X.509 credential stores such as X509FileCredentialStore for loading keys and certificates. Release 6.1.0 added an X509Certificate::getPublicKeyType() accessor so the signing algorithm is derived from the actual subject public key instead of the issuing CA's algorithm. Non-RSA keys, including EC certificates issued by an RSA CA, are now explicitly rejected with an unsupported certificate public key type error.
- What changed in LiteSAML 6.1.0 and will it break my IdP integration?
- 6.1.0 is a key-handling correctness release: the signing algorithm is now read from the certificate's actual public key type rather than inferred from the issuer algorithm. X509FileCredentialStore preserves the issuer algorithm only when it is RSA-SHA256, RSA-SHA384 or RSA-SHA512; otherwise it signs with rsa-sha256. SHA-1-issued certificates now sign with rsa-sha256, MD5-issued certificates no longer crash, and non-RSA keys are rejected outright. The API change is additive with no removals or namespace changes, but partner IdPs that only accept rsa-sha1 will break, so budget an interoperability test cycle per federation partner.
- Is LiteSAML safe for production given XML Signature Wrapping issues?
- The library had an XML Signature Wrapping vulnerability in 5.0.0 that was fixed in 5.0.1, along with a follow-up fix for duplicate or missing assertion IDs. That response record is reasonable, but it is also a reminder that in SAML the library is the trust boundary and XSW is the canonical authentication bypass class of bug. Pin exact versions, subscribe to security advisories, and re-run negative tests on every upgrade. Note also that the MD5-issuer tolerance added in 6.1.0 is robustness for legacy parsing, not an endorsement, so your certificate onboarding policy must explicitly reject weak issuer chains.
- Can I build a full SAML Service Provider or Identity Provider with this package alone?
- You get the protocol building blocks but not the flows. Login initiation, assertion validation policy, session establishment, logout, clock skew handling, replay caching and attribute mapping are all yours to implement. That makes the package strongest when you own an application framework and want SAML inside your domain model, or when you are building an IdP or broker. It is weakest when the requirement is SSO delivered quickly with minimal headcount, in which case the litesaml/saml wrapper or a full SAML product is the better fit.
- How do I test a LiteSAML integration in Laravel?
- The library itself is covered by unit tests running in GitHub Actions, and its typed data model makes it easy to build AuthnRequest, Response and Assertion objects in your own test suite and round-trip them through XML serialization. For Laravel, write feature tests that post real base64-encoded SAML messages to your controller, plus negative tests for tampered signatures, wrapped assertions and expired conditions. Always include an interoperability check against each partner IdP's actual metadata and accepted signing algorithms before deploying.
Weaver
How can I help you explore Laravel packages today?