- Can I install pdias/SamlBundle in a Laravel application?
- Technically Composer can install it, but there is no Laravel service provider, facade, or publishable config in the package. It registers a Symfony Bundle class, a DependencyInjection extension, compiler passes, and security firewall listeners, none of which Laravel boots. Installing it into a Laravel app gives you an unused dependency rather than working SSO.
- Does pdias/SamlBundle support Laravel 10 or Laravel 11?
- No. It is a Symfony bundle and the last release was 2019-10-24, which predates Laravel 9, 10, and 11 as well as PHP 8.1 deprecations. There is no Laravel version constraint or Laravel integration code in the package. Treat any claim of Laravel compatibility as unsupported.
- What is pdias/SamlBundle actually used for?
- It adds SAML 2.0 Service Provider support to Symfony applications as a thin configuration and dependency-injection wrapper around a SAML toolkit, historically the OneLogin php-saml lineage. The real protocol work such as AuthnRequest creation, SAMLResponse parsing, XML-DSig validation, assertion decryption, and metadata generation is done by the underlying library. The bundle mainly wires SP settings and controller flow.
- Is pdias/SamlBundle still maintained?
- No. The last release was 2019-10-24, roughly six years ago, with about 16 GitHub stars and zero dependents. There are no downstream bug reports because almost nobody uses it, and there is no CVE or advisory coverage for the package. For an authentication component, that is a liability rather than a sign of stability.
- Is pdias/SamlBundle safe to use on a production authentication path?
- The assessment is that it should not be used there. SAML failures are authentication bypasses, not broken pages, and a stale pinned toolkit may miss XXE and signature-wrapping (XSW) mitigations. There is no composer audit or security-advisory coverage for a 16-star bundle with zero dependents. Stale dependencies plus PHP 8.x incompatibilities make it unfit for a production auth path.
- What should Laravel developers use instead of pdias/SamlBundle?
- There is no well-maintained, Laravel-native SAML Service Provider package, so the recommended pattern is a thin internal bridge. Use a maintained SAML toolkit such as current OneLogin php-saml or LightSAML as the protocol layer, and author a small Laravel package with a service provider, publishable config, and a guard or middleware that maps assertions to Eloquent users. If the IdP requirement is really enterprise SSO, OIDC via a maintained vendor SDK is usually cheaper.
- How do I configure a SAML Service Provider in Laravel?
- You need an entity ID, ACS URL, single logout endpoints, signing and encryption certificates, NameID format, and attribute mapping. pdias/SamlBundle is useful as a reference for which SP knobs exist, but the configuration must be reimplemented in Laravel config files and a service provider. Do not rely on the Symfony bundle's DI tree or firewall wiring.
- Why might pdias/SamlBundle break on PHP 8 or newer Symfony versions?
- Its 2019 release predates PHP 8.1 deprecations, so dynamic property warnings, removed mcrypt remnants, and typed signature changes in transitive dependencies can surface. The bundle's Symfony compiler passes and firewall wiring also target older Symfony kernel APIs. None of this is patched in the package.
- Can I fork pdias/SamlBundle and adapt it for Laravel?
- The MIT license makes forking and vendoring legally clean, but forking changes the cost model entirely. You would own a security-critical auth component, including patching the underlying SAML toolkit for XSW and XXE issues and testing metadata rotation against modern IdPs. That is usually more expensive than writing a small Laravel bridge over a maintained toolkit.
- Does pdias/SamlBundle handle SAML metadata, ACS endpoints, and single logout?
- The bundle exposes configuration for SP metadata generation, assertion consumer service URLs, and single logout endpoints, but the actual protocol handling is delegated to the underlying toolkit. It does not provide a Laravel route, controller, or middleware for those endpoints. In Laravel you would implement the ACS and SLS routes yourself.