- What is overtrue/laravel-saml and what does it do?
- It is a Laravel package that adds SAML 2.0 Service Provider support, built on OneLogin's SAML PHP Toolkit. It publishes a config file, registers login and logout routes plus middleware, and maps your identity provider and SP settings into Laravel's container. It deliberately does not impose a user model or persistence layer, so you decide how SAML assertions map to your application's users.
- How do I install and configure overtrue/laravel-saml in a Laravel app?
- Install it with Composer and publish the package config, then fill in your IdP entity ID, single sign-on URL, and x509 certificate along with your SP entity ID and assertion consumer service URL. Register the provided routes or middleware, then point your IdP metadata at your application's ACS endpoint. Most integration effort goes into attribute mapping and certificate handling rather than package code.
- Which PHP and Laravel versions does overtrue/laravel-saml 2.0.0 require?
- Version 2.0.0 requires PHP 8.3 or higher and Laravel 13.x. It is a platform-floor release rather than a feature release: SAML APIs, config keys, security defaults, validation policy, and logout response behavior are explicitly preserved from 1.x. The only breaking change is the runtime requirement.
- Can I use overtrue/laravel-saml on Laravel 9, 10, 11, or 12?
- No. Applications on Laravel 9 through 12 cannot install 2.0.0 and must stay on the 1.x line. Attempting to install 2.0.0 will produce a Composer platform conflict, and loose version constraints can break a deploy pipeline. Check whether Laravel 13 is on your upgrade roadmap before planning adoption.
- Does overtrue/laravel-saml support single logout (SLO)?
- Yes, the package provides logout routes and preserves logout response behavior in 2.0.0. That said, single logout is the path least exercised by the automated test suite. If you depend on SLO, verify the flow end to end against your specific identity provider before relying on it in production.
- Can overtrue/laravel-saml handle multiple identity providers or multi-tenant setups?
- Version 2.0.0 fixes a bug where explicitly passed IdP settings incorrectly invoked the configuration resolver, which matters for multi-tenant or per-environment IdP configuration. That makes per-tenant IdP selection more reliable, but it does not give you an IdP test matrix. Validate assertion attribute mapping and certificate handling separately for each provider you support.
- Is overtrue/laravel-saml production ready and how well is it tested?
- The 2.0.0 release ships 26 tests and 100 assertions across PHP 8.3, 8.4, and 8.5, covering signed response acceptance, unsigned and tampered assertion rejection, and request ID mismatch rejection. The maintainers state explicitly that no live identity provider integration test was performed. Treat the suite as a baseline and re-validate signed responses, attribute mapping, clock skew tolerance, and logout behavior against your own IdP.
- What changed in overtrue/laravel-saml 2.0.0 error handling?
- PHP errors and TypeErrors raised during SAML processing are now preserved instead of being masked by a secondary TypeError inside AssertException. Previously a genuine authentication failure could surface in logs and alerting as a misleading type error, which slowed incident diagnosis. If your dashboards or alert signatures key off the old behavior, review them before upgrading.
- Who maintains overtrue/laravel-saml and what is the supply chain risk?
- It is a single-maintainer package that sits directly on the authentication critical path. That implies bus-factor and supply-chain exposure regardless of release quality, and it should be acknowledged in your risk register. Pin the version, monitor advisories, and make sure your on-call runbook covers SAML failures and IdP certificate rotation.
- When should I use something other than overtrue/laravel-saml for SSO?
- It fits well when you run a Laravel monolith or a small number of Laravel services doing SP-initiated SSO against one or a few IdPs. For polyglot estates spanning PHP, Node, and Java, a shared gateway, IdP-side proxy, or OIDC front door is the better long-term architecture with this package as a downstream consumer. Also confirm whether 1.x still receives security fixes if you must defer the PHP 8.3 and Laravel 13 upgrade.