Weave Code
Filament Spid Laravel Package
offline-agency/filament-spid
Filament plugin that adds SPID login to your admin panel, letting Italian users sign in with their digital identity. Configure the SPID providers, map SAML responses to users, and secure Filament access without building the integration yourself.
At a glance
Frequently asked questions about Filament Spid
- What is offline-agency/filament-spid and what does it actually do?
- It is a Filament plugin that adds SPID login to a Filament admin panel, letting Italian users sign in with their digital identity. Architecturally it is not a standalone auth library: it is an integration layer over italia/spid-laravel, which wraps onelogin/php-saml for the SAML 2.0 service-provider role. The plugin ships HandleSpidLogin and HandleSpidLogout listeners that provision the user, authenticate on the panel guard, and call FilamentUser::canAccessPanel() before granting access. The ACS endpoint (spid-auth_acs) and auth events belong to italia/spid-laravel, not to this package.
- How do I install filament-spid in a Laravel Filament application?
- You install it with Composer, but the prerequisite chain is heavy: the package requires minimum-stability beta, cweagans/composer-patches enabled, and a patched fork of italia/spid-laravel. After that, run php artisan filament-spid:install, which validates key material paths, shows a plan, publishes non-destructively, is idempotent on re-runs, and exits 1 on anything unsafe. Note that the installer edits bootstrap/app.php and your panel provider using PHP's tokenizer, so review the diff in a pull request rather than running it blind in CI.
- Which PHP and Laravel versions does filament-spid support?
- Version 1.0.0 targets PHP 8.3+ and Laravel 12 through 13. Laravel 11 and PHP 8.2 were dropped, which is defensible given EOL and security advisories but forces an upgrade on any host application still on 11.x before this package can be adopted. Check your app's framework and PHP floor before adding the dependency.
- Why does filament-spid need a patched fork of italia/spid-laravel?
- Every published upstream version of italia/spid-laravel pins onelogin/php-saml 4.1.0, which is affected by CVE-2025-66475, so Composer refuses to install it. The workaround is a private patched fork plus cweagans/composer-patches and minimum-stability beta. That is a supply-chain and dependency-governance decision rather than a simple composer require, so get sign-off and confirm who owns the fork and its exit plan for when upstream ships a fixed release.
- How does filament-spid map SPID SAML responses to Laravel users?
- The HandleSpidLogin listener provisions and authenticates the user from the SAML attributes returned by the identity provider. In 1.0, auto_create_users defaults to false, so users are not created automatically unless you enable it. The email fallback also changed from [email protected] to the [email protected] domain, and with update_user_data enabled existing accounts are rewritten on next login, which means anything keyed on email can drift.
- Why are SPID logins being refused after installing filament-spid?
- The plugin fails closed: logins below filament-spid.minimum_level are rejected, and that defaults to SpidL2 while italia/spid-laravel itself defaults to SpidL1. Combined with auto_create_users defaulting to false, this can look like an outage to users if you deploy without configuring it. Check the SPID level your identity provider actually provisions and adjust the minimum level deliberately rather than lowering it blindly.
- How does filament-spid enforce Filament panel access and guards?
- The login listener authenticates on the panel guard and calls FilamentUser::canAccessPanel() before granting access, so your existing panel authorization logic still applies. The filament-spid.panel setting pins exactly one panel, so decide which panels and guards are in scope. On multi-panel applications the plugin returns null from SpidPlugin::resolve() outside the SPID panel, which keeps the blast radius small.
- Can I use filament-spid on more than one Filament panel?
- Not with the current configuration: filament-spid.panel pins exactly one panel. If you need SPID on multiple panels you will have to evaluate whether separate configuration, guards, or a custom listener setup is required before committing to the package. For a single Italian admin panel the plugin is a reasonable fit.
- Is passing the metadata validator enough to be SPID or AgID compliant?
- No. The metadata validator deliberately records HOSTED_VALIDATOR_NOT_RUN and FORMAL_AGID_ACCEPTANCE_NOT_OBTAINED, so passing it is not AgID accreditation. SPID is a regulated identity scheme, and the AgID test cycle and evidence pack should be planned as a separate track. You also need an AgID-registered service provider with a valid key pair and metadata, or that registration has to start now.
- What system dependencies does filament-spid need in CI and production?
- The pinned spid_sp_test 1.2.18 package brings a xmlsec1 system dependency, so your CI and production images must supply xmlsec1 and allow outbound HTTPS to identity provider metadata URLs. Since the stack also includes a private fork and a patch for CVE-2025-66475, treat dependency updates as ongoing maintenance work rather than a one-off setup. Confirm image and network requirements before rollout, and note the release changelog is truncated in the Changed section, so get the full changelog before sign-off.
Weaver
How can I help you explore Laravel packages today?