Schemas Laravel Package

Product Decisions This Supports

• SAML 2.0 Integration for Laravel: Enables seamless SAML-based authentication (e.g., SSO, federated identity) within Laravel applications without heavy dependencies like onelogin/php-saml or simple-samlphp. Ideal for projects requiring lightweight, PHP-native SAML validation while leveraging Laravel’s ecosystem.
• Compliance & Security: Supports HIPAA, GDPR, or SOC2 requirements by ensuring XML schema validation for SAML assertions/responses, reducing risk of malformed payloads.
• Roadmap Efficiency: Accelerates development of identity-related features (e.g., partner integrations, HR portals) by providing pre-built schemas and validation logic, cutting weeks of manual XML schema work.
• Build vs. Buy: Favors "buy" for schema validation (vs. custom XML parsing) to avoid technical debt, especially for teams without SAML expertise. The MIT license and minimal dependencies align with Laravel’s philosophy of simplicity.
• Use Cases:
  • Laravel-based IdPs/SPs: Integrate with external identity providers (e.g., ADFS, Okta) or act as a service provider for SAML-enabled services.
  • Legacy Modernization: Migrate older PHP/Laravel systems to SAML without rewriting core authentication logic.
  • Internal Tools: Secure internal portals (e.g., employee directories, vendor access) with SAML assertions.
  • API Gateways: Validate SAML tokens in Lumen or Laravel API endpoints before processing requests.
  • Event-Driven SAML: Process SAML messages in Laravel Queues or Horizon for async validation (e.g., webhook handlers).

When to Consider This Package

• Adopt if:

  • Your Laravel/PHP 8.1+ project needs SAML 2.0 schema validation without bloating dependencies.
  • You’re integrating with existing SAML libraries (e.g., litesaml/core) or need schemas for custom implementations.
  • Your team lacks XML schema expertise or wants to avoid reinventing validation wheels.
  • You prioritize low-maintenance dependencies (MIT license, active CI/CD, no external PHP extensions required).
  • Your use case is SAML 2.0 focused (not SAML 1.1 or WS-Federation) and doesn’t require full SAML stack features (e.g., authentication flows).
  • You’re using Laravel’s service container and want to inject schemas dynamically (e.g., for testing or modular validation).

• Look elsewhere if:

  • You need a full SAML stack (authentication, authorization, protocol handling). Consider:
    • onelogin/php-saml (Symfony-based, feature-rich but heavier).
    • simple-samlphp/simple-saml-php (enterprise-grade, but overkill for lightweight needs).
  • Your project requires SAML 1.1 or WS-Federation (this package is SAML 2.0 only).
  • You’re constrained by PHP < 8.1 or need multi-language support (e.g., Java/.NET).
  • You need enterprise support (this package has minimal adoption signals; 0 stars/dependents).
  • Your Laravel app uses Lumen or a micro-framework where dependency overhead is critical (though this package is lightweight).
  • You require custom SAML profiles (e.g., ECP, Artifact Binding) beyond standard SAML 2.0 schemas.

How to Pitch It (Stakeholders)

For Executives: *"This package (litesaml/schemas) provides pre-validated SAML 2.0 XML schemas for Laravel, enabling secure identity integrations (e.g., SSO, partner logins) with minimal development effort. It’s a low-risk, MIT-licensed dependency that:

• Reduces technical debt by avoiding custom XML schema work.
• Accelerates compliance (HIPAA/GDPR) with built-in validation.
• Fits Laravel’s ecosystem without heavy frameworks. Recommend for projects needing SAML validation—like adding vendor portals or modernizing legacy auth—without the complexity of full SAML stacks."

For Engineering (Laravel Devs): *"The litesaml/schemas package delivers SAML 2.0 schemas and validation in a Laravel-friendly way. Key benefits:

• Lightweight: No external dependencies beyond PHP 8.1+ (works with Laravel’s service container).
• Flexible: Fetch schemas by name (e.g., AuthnRequest, Response) and validate XML in one line:

  $isValid = app(LiteSAML\Schemas\Schemas::class)->validateSchema('AuthnRequest', $xml);
  

• Integrates with Laravel:
  • Bind to the container for dependency injection:

    $this->app->bind(LiteSAML\Schemas\Schemas::class, function ($app) {
        return new LiteSAML\Schemas\Schemas();
    });
    

  • Use in API routes, queues, or service classes for SAML validation.
• Tradeoffs:
  • Minimal adoption (0 stars/dependents), but the core logic is battle-tested in the LiteSAML project.
  • SAML 2.0 only—not a replacement for full SAML libraries like onelogin/php-saml. Ideal for greenfield SAML projects or extending Laravel apps with schema validation (e.g., validating inbound SAML assertions from IdPs)."

For Security/Compliance Teams: *"This package ensures SAML XML schema compliance out of the box, which is critical for:

• Preventing malformed SAML attacks (e.g., XML injection, schema violations).
• Meeting audit requirements (e.g., logging validation failures with SAML message IDs).
• Reducing false positives in SAML-based authentication flows. Recommend for projects where SAML validation is a gateway to secure integrations (e.g., healthcare, finance)."