Weave Code
Php Saml Laravel Package
onelogin/php-saml
PHP toolkit for adding SAML 2.0 SSO to your app. Handles login/logout, assertion processing, metadata generation, and signature/encryption validation, with strict security options and PHP 7.3+ (4.x) or older PHP support via branches.
Simple SAML toolkit for PHP
Frequently asked questions about Php Saml
- How do I integrate onelogin/php-saml into Laravel’s authentication system?
- Use Laravel’s service provider to bind the SAML auth class, then map SAML endpoints (ACS, SLO) to routes. After processing assertions, resolve users via a custom resolver (e.g., `User::firstOrCreate(['email' => $samlResponse->getNameId()])`) and log them in with `Auth::login()`. Example: `Route::post('/saml/acs', [SamlController::class, 'handleAssertion']);`
- Which Laravel version supports onelogin/php-saml 4.x (PHP 7.3+)?
- Laravel 8.0+ (PHP 8.0+) is fully compatible with the 4.x branch. For Laravel 7.x (PHP 7.3–7.4), use the 4.x branch but test thoroughly. Avoid Laravel 6.x or older due to PHP 7.2’s EOL risks. Check the package’s `composer.json` for exact PHP version constraints.
- Can I use Laravel’s .env for SAML configuration instead of settings.php?
- Yes. Replace `settings.php` with Laravel’s `.env` by binding config values in your service provider. Example: `SAML_SP_ENTITY_ID=your-sp-id` in `.env`, then access via `config('saml.entity_id')`. This avoids Composer update risks and centralizes settings with Laravel’s config cache.
- How do I handle SAML errors (e.g., invalid signatures) in Laravel?
- Wrap SAML operations in try-catch blocks to catch `OneLogin_Saml2_Error` exceptions. Convert them to Laravel responses (e.g., `abort(403, 'Invalid SAML signature')`) or log them via Laravel’s logging system. For user-facing errors, create a custom error page in `resources/views/errors/saml.blade.php`.
- What’s the best way to test SAML flows in Laravel?
- Use mock IdPs like SimpleSAMLphp for local testing or libraries like `laravel-saml-testing` for assertions. Test edge cases (e.g., expired assertions, invalid signatures) with PHPUnit. For ACS/SLO endpoints, mock HTTP requests with Laravel’s `Http::fake()` or `Testing::followRedirects()`.
- Does onelogin/php-saml support Laravel’s queue system for async processing?
- Yes. Offload heavy tasks (e.g., metadata parsing, XML validation) to Laravel queues. Dispatch jobs like `SamlMetadataSyncJob` with `dispatch()` and process them in a queue worker. This improves performance under high traffic by avoiding blocking I/O during SAML flows.
- How do I secure RelayState to prevent open redirect vulnerabilities?
- Validate `RelayState` against a whitelist in Laravel’s middleware or controller. Example: `if (!in_array($relayState, config('saml.allowed_relay_states'))) abort(403);`. Store allowed states in `.env` or a database table. Avoid dynamic RelayState values from untrusted sources.
- What are the PHP extension requirements for onelogin/php-saml in Laravel?
- The package requires `openssl`, `mcrypt` (for encryption), and `curl` (for metadata parsing). Ensure these are enabled in your Laravel environment (e.g., `php -m` in Docker/Forge). Use `composer require ext-openssl` if missing, or add extensions to your Dockerfile.
- Can I dynamically generate SP metadata in Laravel instead of using metadata.php?
- Yes. Use Laravel’s config system to define SP metadata (e.g., `config('saml.entity_id')`) and generate the XML dynamically in a controller or service. Example: `Saml::metadata('sp', ['entityId' => config('saml.entity_id')]);`. Cache the output to avoid regenerating on every request.
- What alternatives exist for SAML in Laravel if onelogin/php-saml doesn’t fit?
- Consider `league/saml2` (more modular, PSR-7 compatible) or `onelogin/laravel-saml` (a Laravel-specific wrapper for this package). For IdP-only needs, evaluate `simple-samlphp`. If you need OAuth2 + SAML, `gluu/federation` supports hybrid flows. Assess each based on your Laravel version and PHP support requirements.
Weaver
How can I help you explore Laravel packages today?