Stepup Saml Bundle Laravel Package

Product Decisions This Supports

• Federated identity roadmap — deciding whether to ship SAML 2.0 single sign‑on (SP and/or IdP roles) in a Symfony 7 product, and whether to build that glue in‑house or adopt SURFnet's integration.
• Build vs. buy on the "glue layer" — the underlying SAML protocol work is already done by simplesamlphp/saml2; this package is the Symfony bundle that wires it into DI, config, routing, and the security firewall. The real PM question is whether to own that plumbing or inherit it.
• Higher‑education / research market entry — if your roadmap targets Dutch or European research and education (SURFconext, eduGAIN) or any institution that expects SAML federation, this is a direct enabler rather than a competitive differentiator.
• Step‑up authentication / assurance levels — the SURFnet "Stepup" family is specifically about raising authentication level (e.g., eIDAS, DigiD) mid‑session. If assurance‑level requirements are on your compliance roadmap, this is aligned with that direction.
• Vendor and legal risk review — Apache‑2.0, an actively maintained release line, and a credible institutional backer (SURFnet) make this a low‑legal‑friction dependency, though the low star count and zero recorded dependents should be sized as a concentration risk.
• Non‑fits to rule out now — this package does not serve OpenID Connect/OAuth, does not help a Laravel codebase, and does not give you a hosted IdP.

When to Consider This Package

Consider adopting when:

• The application is Symfony 7 (this is a bundle — the prompt's "Laravel/PHP" framing should be corrected; it will not drop into Laravel).
• You need SAML 2.0 service provider or identity provider behavior and want configuration‑driven setup (YAML/env) rather than hand‑written protocol code.
• You are in or selling into the SURF/OpenConext ecosystem, where the conventions, metadata handling, and step‑up flows are already established.
• You want to avoid re‑implementing Symfony security‑firewall and container wiring around simplesamlphp/saml2 — that integration is where most teams lose weeks.
• Your team has (or can contract) someone who understands SAML metadata, certificates, and attribute mapping, because the bundle will not make SAML concept‑free.

Look elsewhere when:

• The product is Laravel — evaluate 24slides/laravel-saml2 or aacotroneo/laravel-saml2, or a managed provider.
• You actually need OIDC/OAuth2 — use a dedicated client bundle (e.g., knpu/oauth2-client) rather than forcing SAML.
• You need broad community support, tutorials, and hiring pool — 14 stars and 0 recorded dependents means the support surface is thin, and dependents are likely undercounted because most usage is private/institutional.
• You would rather not own federation at all — a managed IdP (Keycloak, Okta, Auth0, WorkOS) removes the operational burden of metadata, key rotation, and certificate expiry.
• You are outside the SURFnet/Symfony‑7 niche and the small‑project maintenance risk outweighs the saved integration effort.

How to Pitch It (Stakeholders)

For executives (one paragraph): This is a small, open‑source (Apache‑2.0) Symfony component that connects our application to institutional single‑sign‑on using the SAML 2.0 standard, backed by SURFnet, the Dutch national research‑and‑education network. Adopting it converts a multi‑week identity‑integration project into configuration work and avoids us hand‑building security‑sensitive authentication code. The trade‑off is that it is a narrow, low‑visibility project rather than a mainstream library, so we should pilot it, pin the version, and keep a fallback plan. Recommended next step: a two‑week proof of concept against one real federation partner.

For engineering (summary): A Symfony 7 bundle that wraps simplesamlphp/saml2 — you get DI wiring, bundle configuration, and framework integration for SAML SP/IdP, including step‑up flows. It is not a Laravel package and not a SAML implementation itself; the protocol lives in the underlying library. Actively released, Apache‑2.0, but a small community, so treat it as a pinned, vendor‑backed dependency rather than a community‑supported one. Budget time for certificate/key rotation, metadata refresh, and attribute‑mapping work — the bundle removes plumbing, not SAML expertise.