Weave Code
Xml Security Laravel Package
simplesamlphp/xml-security
PHP library implementing XML signatures and encryption for the xmldsig and xmlenc standards. Built on xml-common, it offers extensible, secure APIs to sign, verify, encrypt, and decrypt XML objects, with low-level access for custom implementations.
SimpleSAMLphp library for XML Security
Frequently asked questions about Xml Security
- What is simplesamlphp/xml-security used for in a Laravel app?
- It implements XML Digital Signature and XML Encryption for the xmldsig and xmlenc standards, so you can sign, verify, encrypt, and decrypt XML objects. In Laravel it is most relevant for SAML, WS-Federation, or XAdES-style document workflows where you need control beyond a typical SAML package.
- How do I install simplesamlphp/xml-security in Laravel?
- Install it with Composer using composer require simplesamlphp/xml-security. There is no Artisan install command; you wire it into Laravel yourself via configuration and, if needed, a service provider.
- Does simplesamlphp/xml-security have native Laravel support or a service provider?
- No, it is a framework-agnostic PHP library built on xml-common; it does not ship a Laravel service provider or facade. In Laravel you bind any needed backend or wrapper in your own service provider and keep application code behind your own interface.
- Which Laravel and PHP versions does simplesamlphp/xml-security support?
- The package is framework-agnostic and does not publish Laravel version constraints. Laravel compatibility is determined by your app's PHP version and the package's Composer requirements, so check composer.json and run the suite on your target Laravel and PHP matrix.
- Can I use simplesamlphp/xml-security to sign and verify SAML assertions in Laravel?
- Yes, you can use its low-level signature and encryption APIs to sign, verify, encrypt, and decrypt XML such as SAML assertions, but it is not a full SAML protocol library. You still need to handle SAML flows, bindings, and metadata, often through a SAML package or your own implementation.
- How do I configure the v3.1.0 private key agent in Laravel?
- Treat backend selection as configuration: bind a signing service in a Laravel service provider and read agent endpoint, credentials, and TLS settings from config or secrets. Keep application code unaware of whether signing is local or remote so you can test with a fake backend and migrate agents later.
- Is the remote private key agent suitable for production request flows?
- A synchronous network hop on a user-facing SAML redirect adds latency and a failure point, so do not put it blindly in the request path. Use strict timeouts, fail closed rather than silently falling back to a local key, and queue or precompute signatures where the protocol allows.
- How should I test XML signing and encryption in a Laravel application?
- Unit-test your XML objects and verification logic with local keys or a fake signing backend, and mock the agent client so tests never depend on a live HSM or key-management host. Add integration tests against a disposable agent for timeout, authentication failure, and rotated-key scenarios.
- What are alternatives to simplesamlphp/xml-security for SAML in Laravel?
- For straightforward SAML SP or IdP login, onelogin/php-saml or shibboleth/php-saml are usually simpler defaults. Choose simplesamlphp/xml-security when you need lower-level xmldsig/xmlenc control, custom canonicalization, or remote key custody via a private key agent.
- Is simplesamlphp/xml-security actively maintained, and what should I check before upgrading from v2 to v3?
- It is maintained under the SimpleSAMLphp project and has CI, PHPStan, and coverage badges, but the v2.0.0 to v3.1.0 jump is a major-version signal. Read the v3.0.0 changelog and UPGRADING guide, diff your use of XMLSecurityDSig and XSD validation, and upgrade on a branch with a full test run.
Weaver
How can I help you explore Laravel packages today?