Weave Code
Saml2 Laravel Package
simplesamlphp/saml2
A PHP library providing SAML2 protocol functionality for authentication and federation, used by SimpleSAMLphp and OpenConext. Intended for developers familiar with the SAML2 specification.
SimpleSAMLphp low-level SAML2 PHP library
Frequently asked questions about Saml2
- What is simplesamlphp/saml2 used for?
- It is a low-level PHP library that provides SAML 2.0 protocol primitives such as typed message objects, metadata entities descriptors, HTTP-Redirect and HTTP-POST binding helpers, and XML signature signing and validation. It is the foundation used by SimpleSAMLphp and OpenConext, not a complete service provider or identity provider. In a Laravel app, treat it as infrastructure for a bespoke SAML implementation, not as a turnkey login package.
- Is simplesamlphp/saml2 suitable for a standard Laravel login with Okta or Azure AD?
- Usually no. For a standard log in with Okta or Azure AD service provider, a higher-level package or SimpleSAMLphp itself is the better fit because this library does not provide SP session handling, request orchestration, metadata refresh, or an opinionated security posture. Use simplesamlphp/saml2 only when you need specific binding or metadata behavior and have in-house SAML2 expertise.
- How do I install and configure simplesamlphp/saml2 in a Laravel application?
- Install it with Composer, for example composer require simplesamlphp/saml2:^4.0, and wire it behind a Laravel service provider. You must implement \SimpleSAML\SAML2\Compat\AbstractContainer and register it through ContainerSingleton::setContainer(), because the library expects that compatibility container globally. Fence this setup off carefully so it does not leak into unrelated code or tests.
- Which version of simplesamlphp/saml2 should I use?
- The 4.x line is the preferred, mature, supported version and is the one to pin for most Laravel integrations. The 3.x branch is LTS and supported while supported SimpleSAMLphp releases use it, while older branches are unsupported. v5 and v6 are rewrites; v5 is explicitly not a replacement for v4, and the planned drop-in v4 replacement is scoped for v6.1 but is not shipped.
- Does simplesamlphp/saml2 work with Laravel Octane?
- It can work, but the global ContainerSingleton is a production concern in long-running workers because state can survive between requests. Register the compatibility container deliberately and ensure it is reset or isolated correctly under Octane. Test request isolation and ordering carefully rather than assuming normal PHP-FPM behavior.
- What security risks should I know before using simplesamlphp/saml2?
- The library's core job is XML signature validation, canonicalization, and assertion processing, which is exactly where XML Signature Wrapping, assertion replay, and comment-truncation attacks appear. Its release history includes security fixes such as CVE-2025-66475 in 4.19.1 and CVE-2025-27773 in 4.17.0, so version drift is a security incident rather than routine maintenance. You need SAML and XML-DSig expertise and a process for prompt upgrades.
- Does simplesamlphp/saml2 support HTTP Artifact binding and SOAP?
- No, not outside SimpleSAMLphp. The README states that the HTTP Artifact Binding and SOAP client do not work outside SimpleSAMLphp. If your Laravel product requires Artifact binding, treat that as a stop-and-replan signal rather than assuming this package covers it.
- Can I use simplesamlphp/saml2 to act as an IdP for downstream customers?
- It is conditional and possible, but you would be building a security product rather than a small feature. The library supplies SAML2 primitives, not full IdP session handling, metadata refresh, or an opinionated security posture, so you must implement and own those concerns. Confirm requirements for SLO, encrypted assertions, attribute queries, and Artifact binding before committing.
- How should I test a Laravel integration that uses simplesamlphp/saml2?
- Unit-test your message construction, metadata parsing, and signature validation paths with known-good and known-bad SAML fixtures. Add integration tests against a controlled test IdP for full request and response flows, and explicitly test that the global compatibility container is isolated between tests. Avoid relying only on mocked signatures because XML canonicalization and wrapping cases are where failures hide.
- Is simplesamlphp/saml2 LGPL-2.1 safe for a commercial Laravel SaaS, or should I consider alternatives?
- LGPL-2.1 is generally fine for server-side SaaS use when you consume it as an unmodified Composer dependency. If you distribute a PHP appliance or bundle it into a redistributed product, legal should confirm the dynamic-linking and disclosure posture. For standard Laravel SAML login, compare higher-level packages or SimpleSAMLphp before taking on this low-level library.
Weaver
How can I help you explore Laravel packages today?