Security Active Directory Laravel Package

Product Decisions This Supports

• Enterprise/B2B SSO roadmap triage. Inbound "can we log in with our company directory?" requests are a recurring enterprise-tier signal. This package is a data point for scoping an AD/LDAP authentication epic — but only as a reference implementation, not a dependency.
• Build vs. buy for directory auth. It gives engineering a cheap prior: AD auth at its core is a credential bind against a domain controller plus a user lookup. Useful for sizing "we could do this ourselves in a sprint" against "we license an IdP."
• Feature tiering. If AD/SSO is repeatedly requested by accounts above a revenue threshold, this argues for gating SSO behind an Enterprise plan rather than shipping it broadly — and for pricing the IdP integration cost into that tier.
• Use-case validation, not selection. The package's existence (and its 16 stars / zero dependents / no release since April 2016) is evidence that this problem is real but that this class of solution is not what teams chose. That's a market signal against hand-rolled bundles.
• Platform-fit decision. Critical finding: despite being filed under "Laravel/PHP," this is a Symfony bundle (Security-ActiveDirectoryBundle, symfony >=2.1). It is not usable in a Laravel application without a rewrite. If your stack is Laravel, this closes the evaluation immediately and pushes you to ldaprecord/LdapRecord-Laravel or an IdP; if your stack is legacy Symfony, it reopens a narrow, time-boxed question.
• Security review gate. Authentication code is the highest-severity surface you can inherit. An unmaintained 2016 auth package is a standing finding in any SOC2/ISO questionnaire — that itself becomes an input to the buy decision.

When to Consider This Package

Consider a 1–2 day evaluation spike (not adoption) only when all of these hold:

• The application is Symfony 2.x/3.x on PHP 5.6–7.x and you cannot upgrade the framework this cycle.
• The requirement is plain bind authentication ("is this user's password valid in the domain?") with no need for group-to-role mapping, nested groups, or directory sync.
• You need to ship a proof of concept to close a single strategic deal, and the POC will not handle production credentials.
• Legal/security has already signed off on a temporary, isolated credential path.

Look elsewhere — decisively — when:

• Your stack is Laravel or modern Symfony (5/6/7) or PHP 8.x. The package predates PHP 7's strict typing era and will not survive a modern runtime; porting it costs more than writing the 100–200 lines it contains.
• You need authorization, not just authentication: AD group → role mapping, group nesting, or user provisioning. Symfony's native Ldap component (with form_login_ldap/http_basic_ldap) covers this and is maintained by the framework.
• You need Azure AD / Entra ID, SAML, OIDC, or MFA. AD-on-prem bind is a shrinking fraction of enterprise identity; building to it now risks solving last decade's problem.
• Zero dependents and a nine-year-old last release are disqualifying for production. No upstream fixes for CVEs, no PHP compatibility patches, no maintainer to escalate to.
• You require auditability: no changelog, no test coverage signal, no security policy, no release cadence to point an auditor at.

How to Pitch It (Stakeholders)

One line: A nine-year-old Symfony bundle for on-premises Active Directory login. It confirms the enterprise SSO demand signal, but it is not a dependency we should ship — it fits neither our Laravel stack nor a supported PHP runtime.

For executives: Customer demand for directory/SSO login is real and concentrated in higher-value accounts. The cheapest correct answer is either the framework-native LDAP support (if we stay on Symfony) or a maintained identity provider (if we need Entra ID/SAML/MFA). This package is a free reference design, worth a day of engineering time to read — zero dollars, zero integration commitment. Do not let a "16 stars, no release since 2016" artifact set our identity strategy.

For engineering: Treat it as documentation, not a library. Read it to confirm the bind-flow shape, then implement against Symfony's maintained Ldap component or an IdP SDK. Inheriting abandoned authentication code means we own every future CVE in the credential path — a cost that dwarfs the ~200 lines we'd save. Recommendation: spike (≤2 days) → decision record → build or buy, with no path that ends in requiring this package in composer.json.

Risk statement to record: abandoned upstream (2016), zero dependents, no security policy, stack mismatch (Symfony-only, pre-PHP 7.2), and authentication blast radius. Net: high opportunity signal, unacceptable adoption risk.