- Does mlightsaml/sp-bundle work with Laravel?
- No. It is a Symfony bundle built around a Bundle class, a DI extension, a configuration tree, service definitions, and HttpKernel event subscribers, none of which Laravel's container or HTTP lifecycle understands. There is no Laravel service provider, adapter, or usage example. Laravel teams should treat it as a specification reference for the SAML flow, not as a dependency.
- Can I install mlightsaml/sp-bundle in a Laravel app with composer require?
- Composer may resolve it, but that tells you nothing about whether authentication works. Bridging symfony/dependency-injection, symfony/http-kernel, symfony/config, and symfony/event-dispatcher into Laravel means hand-booting a container, which is a large surface area pinned to a Symfony major version. The only credible path is to depend on lightsaml/core directly and write the Service Provider yourself, which is a project rather than an integration.
- How do I add SAML 2.0 Service Provider login to a Laravel application?
- You need a Laravel-native SP: metadata, ACS, and Single Logout routes, an auth guard, session state, and a strict assertion validation policy. mlightsaml/sp-bundle does not provide any of that for Laravel, it only ships Symfony-only wiring. Building on lightsaml/core is possible but is still a build, so evaluate a maintained Laravel SAML package or an identity broker first.
- Which Laravel versions does mlightsaml/sp-bundle support?
- None officially. The package targets Symfony, so Laravel version support does not apply, and Laravel 9, 10, or 11 compatibility would be entirely your team's work if you attempted a port. The bundle's config contract is Symfony-shaped and is lost in any Laravel port.
- Is mlightsaml/sp-bundle safe for production authentication?
- Risk here is high and concentrated on the authentication boundary. Upstream LightSAML is effectively unmaintained and PHP 7 era, and the bundle is single-maintainer with no stars, no dependents, and no security disclosure process. Signature validation is the security-critical surface in SAML, so XML Signature Wrapping, XXE and DTD handling, and stale transitive dependencies are live exposure. On auth, no upstream cadence means your team becomes the CVE process.
- What are good Laravel SAML SSO alternatives to mlightsaml/sp-bundle?
- Prefer a Laravel-native SAML Service Provider package with active maintenance and a disclosure process, or use an external identity broker that speaks SAML to the IdP and OIDC to Laravel. Before selecting anything, ask whether SAML 2.0 is genuinely mandated by the IdP or whether OIDC would satisfy the requirement with a far more mature Laravel ecosystem. That question is the cheapest possible resolution and should be asked before any code.
- Does mlightsaml/sp-bundle support IdP-initiated login and Single Logout?
- The bundle is Symfony-oriented, so its flow support is only useful to Laravel teams as a reference. IdP-initiated login with assertion-only validation is where XML Signature Wrapping risk concentrates, and Single Logout is where most we support SAML claims quietly fail. Scope SP-initiated, IdP-initiated, and SLO explicitly before estimating the epic.
- Can I reuse mlightsaml/sp-bundle's attribute mapping or signed AuthnRequests in Laravel?
- Not directly. The bundle's DI configuration and extension tree are Symfony-shaped and are lost in any port, so your team would reimplement the semantics anyway. The reusable asset is the upstream LightSAML core, including XML-DSig handling, AuthnRequest and Response models, and metadata parsing, not the Symfony wrapper. Port targeted logic only if a specific gap appears and keep the wrapper out of your dependency graph.
- What should I scope for a Laravel SAML SSO epic if I cannot use this bundle?
- Scope metadata exchange, signed AuthnRequests, ACS handling and assertion validation, attribute-to-user and role mapping, session establishment, and Single Logout. Name an owner for the Service Provider after launch and define a certificate-rotation review cadence, because if there is no name there is no plan. Compliance obligations such as SOC 2, ISO 27001, or HIPAA usually require a dependency with an active disclosure process and an SLA.
- How should I test SAML authentication in a Laravel application?
- Test at the boundary: replay signed assertions from a test IdP fixture, assert rejection of unsigned, expired, wrong-audience, and XML Signature Wrapping cases, and cover the ACS, metadata, and SLO routes end to end. Because SAML failure is binary, either an outage or an auth bypass, these tests belong in continuous integration rather than a manual checklist. If you inherit logic from LightSAML, pin the version and add dependency scanning.