Lightsaml Laravel Package

Features

• Add X509Certificate::getPublicKeyType() (#133)

Bug Fixes

• Stop deriving the key algorithm from the certificate issuer (#123) (#133)
  • RSA certificates issued by an ECDSA CA (or any non-RSA CA) are now supported.
  • Non-RSA keys are rejected with an explicit Unsupported certificate public key type error, including EC certificates issued by an RSA CA.
  • KeyHelper::createPublicKey() no longer fails with Invalid Key Type for certificates issued with MD5.

Behaviour change

X509FileCredentialStore keeps the certificate issuer's algorithm as signing algorithm only when it is RSA-SHA256/384/512. Otherwise it signs with RSA-SHA256. Certificates issued with SHA-1 now sign with rsa-sha256 instead of rsa-sha1, and certificates issued with MD5 or by an ECDSA CA no longer crash.

Full Changelog: https://github.com/litesaml/lightsaml/compare/6.0.1...6.1.0

Security

• Reject Responses with duplicate assertion IDs (#114)
• Reject assertions with missing or empty ID (#117) (#118)

Bug Fixes

• Throw LightSamlBindingException instead of TypeError in getBindingByRequest() (#116)

Full Changelog: https://github.com/litesaml/lightsaml/compare/5.0.1...5.1.0

Security

• Reject XML Signature Wrapping (XSW) attacks in SignatureXmlReader (#113)

LightSAML 5.0.0 was vulnerable to an XML Signature Wrapping (XSW) attack allowing an attacker who has captured one genuine signed assertion to have LightSAML accept a fully attacker-authored assertion as IdP-signed, leading to authentication bypass and privilege escalation.

The fix enforces two invariants before signature validation: the ds:Signature parent element must carry the ID referenced by the fragment URI, and that ID must be unique in the document.

Full Changelog: https://github.com/litesaml/lightsaml/compare/5.0.0...5.0.1

Breaking Changes

• Remove Pimple bridge and unused implementations (#107)
• Replace symfony/http-foundation with PSR-7 interfaces (#109)
• Bump minimum PHP requirement to 8.4
• Add strong typing to method parameters and return values (#110)
• Remove deprecated Serializable interface from state classes (#111)
• Enforce strict typing and reach PHPStan level 6 zero errors (#112)

Continuous Integrations

• Modernize CI workflows

Documentation

• Recommend litesaml/saml wrapper for high-level usage

Full Changelog: https://github.com/litesaml/lightsaml/compare/4.7.0...5.0.0

Features

• Add RSA-PSS certificate and SAML signature support (#102)
• Include AssertionConsumerServiceURL in outbound AuthnRequest (#103)
• Return SamlMessage from binding receive() method (#105)

Bug Fixes

• Bump dependencies to address security vulnerabilities (#101)
• Use SHA256 as default signing algorithm instead of SHA1 (#104)
• Use SignatureXmlReader instead of abstract Signature in RoleDescriptor deserialization (#106)

Full Changelog: https://github.com/litesaml/lightsaml/compare/4.6.1...4.7.0