stgbundle/cas-bundle
Symfony bundle for CAS (Central Authentication Service) single sign-on. Integrates CAS login and logout with Symfony's security system, with configurable server settings for authenticating users against a CAS server. Useful for adding institutional SSO to existing Symfony applications.
Architecture fit. This is a Symfony bundle, not a Laravel package, and release 8.0 does not change that. Bundles depend on Symfony's kernel, DI container compiler passes, bundle extension classes, and typically symfony/security-* authenticator abstractions — none of which map onto Laravel's service providers, guards, or Authenticatable contract. The 8.0 release notes ("Bundle de cas para symfony 7.4") confirm the maintainer is tracking the Symfony release train, not broadening the packaging surface. There is still no "install and go" path into a Laravel app. The durable value remains the CAS protocol logic (service ticket validation against /serviceValidate, proxy ticket handling, attribute extraction), not the packaging. Treat the repo as a reference implementation to be read and partially reused, not a dependency to be installed.
Integration feasibility. Feasible, but only as an extraction exercise. Scope this as "build a CAS client for Laravel, informed by this bundle," not "adopt this bundle." The work is: isolate the ticket-validation and response-parsing code, replace any Symfony HTTP client usage with Guzzle (already in the Laravel stack), and wrap the result in a service provider plus a custom auth guard and middleware. The 8.0 major-version bump is a mixed signal for this plan: it implies the internals were reworked for Symfony 7.4, so any extraction should be done against a pinned tag with the diff from 7.x reviewed, rather than against main. If the repository implements only a client — likely, given the description — the extraction is a few hundred lines and low drama. If it also implements server-side CAS or ties into Symfony's firewall event listeners (more likely now that it targets Symfony 7.4's authenticator system), the porting cost roughly triples.
Technical risk. High, and concentrated in provenance rather than code — but marginally improved. The 8.0 release targeting Symfony 7.4 is evidence of some maintenance activity, which partially offsets the "abandoned project" concern. It does not offset the rest: three stars and zero dependents still means effectively no external review, no downstream battle-testing, and no vulnerability discovery surface. A security-adjacent package with no users is a package whose CVE would go unnoticed. A one-line, Spanish-only release note for a major version is itself a risk signal — there is no changelog, no migration guide, and no stated breaking-change list for 8.0, so upgrading requires reading the diff. Single-maintainer provenance (deimsantafe) still raises bus-factor and onboarding questions. The 2026-04-24 last-release date previously flagged as anomalous is not resolved by these notes and should be verified directly against Packagist; either it is a metadata artifact or the versioning is not trustworthy, and both outcomes argue for pinning. Opportunity score of 23 and composite of ~11.9 remain consistent with "niche protocol wrapper, unproven."
Key questions.
apereo/phpCAS or jasig/phpCAS? If a fork, what was changed and why not upstream?deimsantafe — an internal team publishing for its own use, or an individual's side project? This determines whether "support" means anything.Stack fit. Poor as a direct dependency; acceptable as a pattern source. The realistic architecture remains a small internal Composer package (acme/laravel-cas) that owns the CAS client, published to a private registry and consumed by each Laravel app. Release 8.0 strengthens the one scenario where keeping the bundle as-is is defensible: if the organization also runs Symfony 7.4 services, the bundle can now be used natively there, and both stacks speak the same CAS server. Note the version asymmetry that creates — Symfony apps on 8.x, the internal Laravel package derived from an 8.x snapshot — and record the provenance tag in the internal package's README so future upstream diffs can be reviewed.
Migration path. Vendor or fork the protocol layer into a first-party repository at a pinned 8.0 tag. Strip Symfony-specific wiring — expect more of it now that the bundle targets Symfony 7.4's authenticator abstractions — retain the request/response and XML-parsing logic, add tests against a containerized CAS server (Apereo CAS in Docker is the standard harness). Then build the Laravel surface: a config/cas.php, a service provider, a CasGuard implementing Illuminate\Contracts\Auth\Guard, and EnsureCasAuthenticated middleware. If existing local accounts must survive the transition, add a user-provisioning listener that maps CAS attributes to the users table on first login. If an earlier extraction spike was already run against a 7.x tag, re-run it against 8.0 rather than assuming the protocol layer is unchanged.
Compatibility. The Symfony 7.4 target is actually helpful here: it implies a PHP 8.2+ floor, which aligns with Laravel 11/12 and removes the "does this run on our runtime" question. Still verify ext-dom/ext-xml availability, TLS trust store configuration for the CAS endpoint, and whether the code uses symfony/http-client (must be swapped for Guzzle or added as an explicit dependency). Confirm the exact composer.json constraints rather than inferring them from the release note — "symfony 7.4" may mean ^7.4 or 7.4.*. Watch for hardcoded defaults: service URLs and CAS server hosts should be config-driven, not baked into the bundle's DI parameters as Symfony config trees tend to encourage, and a major-version rewrite is a plausible moment for defaults to have moved.
Sequencing. (1) Spike: stand up a test CAS server and confirm the extracted client can complete a full ticket round-trip, now explicitly against the 8.0 tag. One to two days, and it de-risks the entire plan. (2) Extract and test the protocol layer in isolation. (3) Build the Laravel guard, middleware, and config. (4) Dual-run — CAS as an optional guard alongside existing auth, gated by config flag. (5) Cut over per application, retiring the flag once login telemetry is clean for a full cycle. Do not parallelize (1) and (2); the spike's outcome decides whether (2) is even the right shape. Add a small, bounded task ahead of (2) to diff 8.0 against the previously reviewed tag, since there is no changelog to substitute for it.
Maintenance. Assume ownership from day one. Forking means the org absorbs bug fixes, PHP version bumps, and security patches, with no upstream obligation to merge anything. Budget a small ongoing allocation — realistically a few days per year if the CAS server config is stable, more if the CAS server is upgraded and attribute mappings shift. The 8.0 release is mild evidence of upstream cadence, which lowers the "dead project" risk slightly, but the absence of a changelog means every upstream bump costs diff-review time on our side; treat that as a fixed line item, not a contingency. Pin exact versions, commit the fork to an internal registry, and add it to the SBOM so dependency scanning actually sees it.
Support. No vendor, no SLA, no issue-triage guarantee, and documentation in Spanish only — confirm the team has a reader or budget for translation. Release notes are a single Spanish sentence for a major version, which sets the expectation: upstream will not tell us what broke. The support model is an internal runbook covering "CAS server unreachable," "ticket validation returns 401," "user attributes changed," and — new given the 8.0 major bump — "upstream released a version and we must decide whether to re-derive." That runbook is a deliverable, not an afterthought.
Scaling. Unchanged. CAS validation is a synchronous network call on the login path, which makes the CAS server a hard dependency for authentication and a correlated failure domain across every integrated app. Mitigate with strict timeouts, connection pooling, a circuit breaker that degrades to a clear error page rather than a hang, and session lifetimes long enough that validation is not per-request. If proxy tickets are in scope, sticky sessions or a shared ticket store become mandatory. Throughput on the Laravel side is not the constraint; the CAS server's availability is.
Failure modes. Ranked by likelihood and blast radius: CAS server outage (total login outage, high); service URL not registered for a new environment (silent redirect failures, high, and a recurring one every time an environment is added); clock skew invalidating short-lived tickets (intermittent, hard to diagnose, medium); XML parsing failures on unexpected attribute payloads (medium, usually on CAS server upgrade); redirect loops from misconfigured service parameters behind a load balancer (medium); session fixation if the guard does not regenerate session IDs post-authentication (low likelihood, severe). Add one new mode introduced by this release: silent behavior drift if the internal package is re-derived from a later upstream tag without a diff review — low likelihood given pinning, but it fails quietly and only at login.
Ramp-up. CAS itself is a mature, well-documented protocol with a small conceptual surface — a developer who has integrated SAML or OAuth before will be productive in a few days. The steeper curve is reading unfamiliar, untested, non-English-commented Symfony bundle internals well enough to trust the extraction, and the Symfony 7.4 authenticator rework in 8.0 means there is now more Symfony-specific machinery to read past before reaching the protocol code. Plan one to two sprints for a mid-level PHP developer including the spike, tests, and the Laravel wiring; add a sprint if proxy tickets or SAML attribute release are required, and add a half-sprint if the 8.0 diff review surfaces changes in the validation path. The ramp-up is entirely front-loaded — once the internal package exists and is tested, each additional Laravel app is a config-only integration.
How can I help you explore Laravel packages today?