Weave Code
Saml2 Laravel Package
socialiteproviders/saml2
SAML2 provider for Laravel Socialite that lets Laravel apps authenticate users through SAML 2.0 identity providers. Add enterprise SSO to your existing Socialite login flow with a familiar driver interface and minimal configuration.
SAML2 Service Provider for Laravel Socialite
Frequently asked questions about Saml2
- How do I install socialiteproviders/saml2 in a Laravel application?
- Install it with Composer using composer require socialiteproviders/saml2. Then register the SocialiteProviders service provider and event listener following the SocialiteProviders convention, and add the saml2 driver configuration for your service provider and identity provider. Check the package README for the exact provider class and listener names because this driver follows the shared SocialiteProviders manager setup.
- What configuration does the SAML2 Socialite driver need?
- You typically configure the SP entity ID, assertion consumer service URL, IdP metadata URL, and signing certificates, along with the Socialite client ID, secret, and redirect URL. The driver also needs an event listener that registers the saml2 provider with Socialite. Exact key names and required values should be confirmed against the package documentation and your IdP metadata.
- Which Laravel and Socialite versions does socialiteproviders/saml2 support?
- The overview does not publish a support matrix, and this is a community SocialiteProviders driver rather than first-party Laravel code. Because Laravel Socialite has had breaking changes across major versions, check the package Composer constraints before upgrading Laravel or Socialite. Test the driver against your exact Laravel, PHP, and socialiteproviders/manager versions.
- Which identity providers work with socialiteproviders/saml2?
- It is designed for SAML2-compliant identity providers such as Okta, Azure AD, and ADFS, but the tested IdP matrix is not stated in the overview. The practical requirement is that your IdP can release the attributes your app needs and accept your SP metadata, including ACS URL and signing certificate. Confirm your specific IdP and attribute release policy before committing to the driver.
- Does socialiteproviders/saml2 support IdP-initiated SSO?
- The driver is positioned as a Socialite provider for common SSO login flows, and the evaluation notes that it implements the SP-initiated web browser SSO profile rather than the full SAML2 feature set. If your enterprise IdP requires IdP-initiated SSO, advanced single logout, artifact binding, or encrypted assertions, verify support or plan to supplement with a lower-level SAML library. Do not assume full SAML2 compliance from the drop-in Socialite framing.
- Does it validate SAML signatures, audience, recipient, and expiration?
- The driver wraps a SAML engine underneath, so signature validation and assertion checks depend on that engine and your configuration. You should verify that it validates response and assertion signatures, audience, recipient, InResponseTo, and NotBefore/NotOnOrAfter values before using it in production. SAML validation is security-sensitive and should be reviewed rather than assumed.
- How are SAML attributes mapped to Socialite user fields?
- The driver maps SAML attributes from the identity provider assertion into the standard Socialite user object, so application code can continue calling Socialite::driver('saml2')->user(). You configure which SAML attributes supply values such as email, name, and unique identifier according to the package configuration. Confirm the mapping against your IdP's released claims and handle missing attributes explicitly.
- How can I test SAML login locally with Laravel Socialite?
- Use a test SAML identity provider or your IdP's sandbox tenant, and point the driver at local callback routes that match the ACS URL registered with the IdP. Socialite's redirect and callback flow can be exercised in feature tests by mocking the Socialite driver user response, while end-to-end tests should validate real assertion handling. Keep test certificates and metadata separate from production configuration.
- Is socialiteproviders/saml2 safe and maintained for production?
- It is a low-visibility community SocialiteProviders driver with an unknown repository and few stars, so maintenance and bus factor are legitimate concerns. The release date in the metadata is anomalous and should be verified, and you should check release cadence, security disclosure process, license, and dependency health. For production SSO, review the SAML engine it wraps and consider a more actively maintained alternative if assurance matters.
- What are alternatives to socialiteproviders/saml2 for SAML in Laravel?
- Lower-level SAML libraries such as onelogin/php-saml or lightsaml give you direct control over SAML requests, responses, and validation without the Socialite abstraction. If your Laravel app already uses Socialite for other providers, this driver can keep login code consistent; if not, adding Socialite just for SAML may be unnecessary. Evaluate alternatives based on IdP-initiated support, validation guarantees, maintenance, and certificate rotation needs.
Weaver
How can I help you explore Laravel packages today?