Weave Code
Php Saml Laravel Package
onelogin/php-saml
onelogin/php-saml adds SAML 2.0 SSO support to PHP applications, including SP- and IdP-initiated login, signed assertions, logout handling, strict mode, and configurable security checks. The 4.x branch supports PHP 7.3+ and PHP 8.x.
PHP SAML Toolkit
Frequently asked questions about Php Saml
- How do I install onelogin/php-saml in a Laravel application?
- Install it with composer require onelogin/php-saml. It is a framework-agnostic PHP library, so no Laravel service provider, facade, or config stub is registered automatically. You build the integration layer yourself: a controller for metadata, ACS, and SLS routes, a config/saml.php array populated from env vars, and a wrapper service around the Auth class.
- Does onelogin/php-saml support Laravel 11 and Laravel 12?
- Yes, indirectly. The 4.x branch supports PHP 7.3+ and PHP 8.x, and it works inside Laravel 11 and 12 because it is plain PHP with Composer autoloading. The only Laravel-version-specific detail is CSRF exemption for the ACS POST endpoint: use VerifyCsrfToken::$except on older versions and validateCsrfTokens()->except() on Laravel 11/12.
- How do I configure onelogin/php-saml as a service provider in Laravel?
- Pass a plain PHP settings array to the Auth constructor, typically built in config/saml.php from environment variables so it survives config:cache. Configure your SP entity ID, ACS and SLS URLs, x509 cert and private key paths, and the IdP entity ID, SSO URL, SLO URL, and signing certificate. Then map the metadata, ACS, and SLS endpoints to three named Laravel routes.
- Why do I get a 419 error on the SAML ACS endpoint in Laravel?
- The ACS endpoint receives a POST from the identity provider with no Laravel CSRF token, so the default CSRF middleware rejects it with a 419. Exempt the ACS route explicitly, using VerifyCsrfToken::$except before Laravel 11 or validateCsrfTokens()->except() in Laravel 11/12. This is a one-line change but a common cause of working locally and failing in staging.
- Where should I store SAML certificates for onelogin/php-saml in Laravel?
- Store certificates in storage/app/saml or a secrets manager, never under vendor/onelogin/php-saml or in config/. The README warns that files under the vendor package directory are destroyed by composer update. Reference the storage paths from your config/saml.php settings array so the certificate locations are environment-specific and not committed to source control.
- How do I prevent SAML replay attacks with onelogin/php-saml?
- The library does not provide replay protection itself. It exposes getLastMessageId() and getLastAssertionId() so you can implement cache-backed deduplication in your Laravel application. Store seen message and assertion IDs in a shared cache such as Redis with a TTL, and reject any response that reuses an ID.
- What security settings must I enable in onelogin/php-saml?
- Set strict to true, use non-SHA-1 signatureAlgorithm and digestAlgorithm values such as SHA-256, and register the IdP signing certificate rather than comparing fingerprints. Enable rejectUnsolicitedResponsesWithInResponseTo and destinationStrictlyMatches, which default to disabled. Add a config validation test in CI so insecure defaults cannot reach production.
- Is onelogin/php-saml maintained and safe to use in production?
- It is effectively a single-maintainer project under the SAML-Toolkits org, with event-driven releases driven by security patches rather than a planned cadence. The real CVE history sits in its transitive xmlseclibs dependency, including CVE-2025-66475 patched in 2.21.1. It has around 1.3k stars and is wrapped by many PHP SAML plugins, so issues are found and patched quickly, but you should pin versions and monitor advisories.
- Can I use onelogin/php-saml with Laravel Auth guards and Eloquent users?
- Yes. Use the library only as a SAML protocol engine, then map SAML attributes to your Eloquent user model and call Auth::login() yourself. Keep your existing guards, policies, and user persistence in Laravel. Wrapping the Auth class behind your own SamlProvider interface from day one makes controllers cleaner and the integration easier to test.
- Does onelogin/php-saml support IdP-initiated and SP-initiated login and logout?
- Yes. It supports both SP-initiated and IdP-initiated login, signed assertion validation, metadata generation and parsing, and single logout message handling. Session state and user persistence are deliberately left to the host application, so you own the Laravel session flow and any shared session store needed for InResponseTo validation across multiple nodes.
Weaver
How can I help you explore Laravel packages today?