Saml2 Laravel Package

This release bumps the minimum required PHP-version to 8.5 and migrates to the new PHP DOM-API that was introduced in PHP 8.4

Fixed CVE-2025-66475

Following up on v5 this is another intermediate step that changes the interface. A major change here is that instead of passing a 'string' to a method and validate that the string is a valid URI, we now pass an AnyURIValue object, drastically reducing the overhead of validating strings multiple times.

Appropriate to use for people who need to generate/parse SAML 2.0 messages/metadata, or use bindings. Still no full replacement for the old v4. We plan to release a full replacement for v4 in v6.1 where we add ServiceProvider/IdentityProvider where you pass all your configuration and metadata and then those classes will do all the heavy lifting to process requests/responses according to the SAML2 specifications.

Until we release a full replacement, we will keep supporting and patching v4

Version 5.0 of this library completely rewrites the library to modern standards. It is a necessary intermediate step for us to migrate away from the old v4, but it is in no way a replacement. You can still use it if your concern is just generating/parsing SAML 2.0 messages/metadata

Fixes CVE-2025-27773

Fix regression (missing use statement) introduced in 4.6.9.

Bugfix

• Make processor aware of assertion types #240

Fix an invalid assertion, leading to an InvalidArgumentException when trying to set the AssertionConsumerServiceIndex on an AuthnRequest

Fix incorrect use of Issuer-class

Fix a mistake in the bugfix for #229

Fixes a bug in HTTPArtifact::receive (#229)

This is a bugfix release of the SAML2 library, fixing a critical security issue (SSPSA 201911-01).

This is a bugfix release of the SAML2 library, fixing a critical security issue (SSPSA 201911-01).

This is a bugfix release of the SAML2 library, fixing a critical security issue (SSPSA 201911-01).

This is a stable release of the SAML2 library.

The most significant changes are:

• Minimum required PHP-version is bumped to 7.2
• Fully typehinted codebase, strict_types=1
• Updated dependencies to their latest version
• Introduced Psalm static analysis

If you are a developer using this library as part of your application, make sure you read the Upgrade Notes

• Add support to provide private key as string in addition to file path

This is a bugfix release: v3.4.0 was accidentally based on master instead of the 3.x branch

• Bugfix for SPProvidedID in NameID fromArray().
• Bugfix for parsing mdui:Logo elements with data: URLs.

• All code has been converted to use the shorthand array syntax
• Getter/setter methods have been added for all public properties; properties will be marked private in the next major release.
• Added support for Conditions/AudienceRestriction/Audience in AuthnRequest (#137)
• More unit-tests have been added
• Upgraded dependencies
• Calls to SimpleSAML_ have been namespaces, deprecated calls to SimpleSAML_Utilities have been replaced by their new counterparts
• Assorted whitespace-fixes / PSR-2 fixes / minor bugfixes

• Fix invalid XML being generated for Assertion element (Signature in wrong position), introduced in v3.2.3. Thanks Dick Visser from Géant for reporting!
• Allow to use integer type attibutes in AttributeQuery.

• More fixes to type hints.

• Revert type hints in AbstractContainer added in v3.2.3, since this might break existing implementations and thus should not have been in a minor release.

• Make Compat Logger PSR-3 compliant.
• Be tolerant of string EPTIs instead of breaking mere parsing of those.
• Code cleanups.

• Update the dependency on xmlseclibs
• Add PasswordProtectedTransport to constants

• Update the dependency on xmlseclibs.

• Change the default signature algorithm from RSA-SHA1 to RSA-SHA256.

  Please note that this change does not remove support for RSA-SHA1. However, when passing a XMLSecurityKey to verify a signature, that key must be created with the RSA-SHA256 algorithm.

• Assertion: fix method "hasEncryptedAttributes".
• Issuer: support to send entity Format and NameQualifier.

• Add PHP 7.2 support
• Fix wrong class name in ECP request processing

• Fix for SSPSA 201803-01.

• Fix for SSPSA 201803-01.

Please note that this is the last 2.x release.