PHPackages                             24slides/laravel-saml2 - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. 24slides/laravel-saml2

Abandoned → [scaler-tech/laravel-saml2](/?search=scaler-tech%2Flaravel-saml2)Library[Authentication & Authorization](/categories/authentication)

24slides/laravel-saml2
======================

SAML2 Service Provider integration for Laravel applications, based on OneLogin toolkit

2.5.2(3mo ago)2773.0M—2.4%84[36 issues](https://github.com/scaler-tech/laravel-saml2/issues)[10 PRs](https://github.com/scaler-tech/laravel-saml2/pulls)1MITPHPPHP >=7.1

Since Feb 4Pushed 2mo ago11 watchersCompare

[ Source](https://github.com/scaler-tech/laravel-saml2)[ Packagist](https://packagist.org/packages/24slides/laravel-saml2)[ Docs](https://github.com/scaler-tech/laravel-saml2)[ RSS](/packages/24slides-laravel-saml2/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (10)Dependencies (15)Versions (50)Used By (1)

Laravel SAML Service Provider
-----------------------------

[](#laravel-saml-service-provider)

> This repository is maintained by [Scaler Tech](https://github.com/scaler-tech) at [scaler-tech/laravel-saml2](https://github.com/scaler-tech/laravel-saml2).
> The package namespace remains `Slides\Saml2` for backwards compatibility.

An integration to add SSO to your service via SAML2 protocol based on [OneLogin](https://github.com/onelogin/php-saml) toolkit.

This package turns your application into Service Provider with the support of multiple Identity Providers.

Requirements
------------

[](#requirements)

- Laravel and PHP version support depends on the package version (see Versioning Policy below)

Getting Started
---------------

[](#getting-started)

### Migrating From Archived `24slides/laravel-saml2`

[](#migrating-from-archived-24slideslaravel-saml2)

Show migration steps`scaler-tech/laravel-saml2` in the `2.5.x` line is fully compatible with the archived original package for existing integrations.

If your `composer.json` currently contains:

```
{
  "require": {
    "24slides/laravel-saml2": "^2.0"
  }
}
```

Switch it to:

```
{
  "require": {
    "scaler-tech/laravel-saml2": "^2.5"
  }
}
```

Then update dependencies:

```
composer update scaler-tech/laravel-saml2 --with-all-dependencies
```

### Versioning Policy

[](#versioning-policy)

- `2.x` is legacy-supported and does not introduce breaking changes.
- `2.5.x` supports PHP `7.0` through `8.5`.
- `2.5.x` supports Laravel `5.5` through `12.x`.
- Versions greater than `2.7.x` require PHP `8.2` or newer.
- Versions greater than `2.7.x` support Laravel `9.x` through `13.x`.
- It is safe to migrate within `2.x` as long as your PHP and Laravel versions are supported.
- `3.x` is currently in development and will include breaking changes, so it will not be backwards compatible with the older package line.

### Installing

[](#installing)

##### Step 1. Install dependency

[](#step-1-install-dependency)

```
composer require scaler-tech/laravel-saml2

```

If you are using Laravel 5.5 and higher, the service provider will be automatically registered.

For older versions, you have to add the service provider and alias to your `config/app.php`:

```
'providers' => [
    ...
    Slides\Saml2\ServiceProvider::class,
]

'alias' => [
    ...
    'Saml2' => Slides\Saml2\Facades\Auth::class,
]
```

##### Step 2. Publish the configuration file.

[](#step-2-publish-the-configuration-file)

```
php artisan vendor:publish --provider="Slides\Saml2\ServiceProvider"

```

##### Step 3. Run migrations

[](#step-3-run-migrations)

```
php artisan migrate

```

### Configuring

[](#configuring)

Once you publish `saml2.php` to `app/config`, you need to configure your SP. Most of options are inherited from [OneLogin Toolkit](https://github.com/onelogin/php-saml), so you can check documentation there.

#### Identity Providers (IdPs)

[](#identity-providers-idps)

To distinguish between identity providers there is an entity called Tenant that represent each IdP.

When request comes to an application, the middleware parses UUID and resolves the Tenant.

You can easily manage tenants using the following console commands:

- `artisan saml2:create-tenant`
- `artisan saml2:update-tenant`
- `artisan saml2:delete-tenant`
- `artisan saml2:restore-tenant`
- `artisan saml2:list-tenants`
- `artisan saml2:tenant-credentials`

> To learn their options, run a command with `-h` parameter. `saml2:update-tenant` keeps existing `name_id_format` unless `--nameIdFormat` is explicitly provided.

Each Tenant has the following attributes:

- **UUID** — a unique identifier that allows to resolve a tenannt and configure SP correspondingly
- **Key** — a custom key to use for application needs
- **Entity ID** — [Identity Provider Entity ID](https://spaces.at.internet2.edu/display/InCFederation/Entity+IDs)
- **Login URL** — Identity Provider Single Sign On URL
- **Logout URL** — Identity Provider Logout URL
- **x509 certificate** — The certificate provided by Identity Provider in **base64** format
- **Metadata** — Custom parameters for your application needs

#### Default routes

[](#default-routes)

The following routes are registered by default:

- `GET saml2/{uuid}/login`
- `GET saml2/{uuid}/logout`
- `GET saml2/{uuid}/metadata`
- `POST saml2/{uuid}/acs`
- `GET|POST saml2/{uuid}/sls`

You may disable them by setting `saml2.useRoutes` to `false`.

> `/saml2` prefix can be changed via `saml2.routesPrefix` config parameter.

Usage
-----

[](#usage)

### Authentication events

[](#authentication-events)

The simplest way to handle SAML authentication is to add listeners on `Slides\Saml2\SignedIn` and `Slides\Saml2\SignedOut` events.

```
Event::listen(\Slides\Saml2\Events\SignedIn::class, function (\Slides\Saml2\Events\SignedIn $event) {
    $messageId = $event->getAuth()->getLastMessageId();

    // your own code preventing reuse of a $messageId to stop replay attacks
    $samlUser = $event->getSaml2User();

    $userData = [
        'id' => $samlUser->getUserId(),
        'attributes' => $samlUser->getAttributes(),
        'assertion' => $samlUser->getRawSamlAssertion()
    ];

    $user = // find user by ID or attribute

    // Login a user.
    Auth::login($user);
});
```

### Middleware

[](#middleware)

To define a middleware for default routes, add its name to `config/saml2.php`:

```
/*
|--------------------------------------------------------------------------
| Built-in routes prefix
|--------------------------------------------------------------------------
|
| Here you may define the prefix for built-in routes.
|
*/

'routesMiddleware' => ['saml'],
```

Then you need to define necessary middlewares for your group in `app/Http/Kernel.php`:

```
protected $middlewareGroups = [
    'web' => [
        ...
    ],
    'api' => [
        ...
    ],
    'saml' => [
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
    ],
```

### Logging out

[](#logging-out)

There are two ways the user can logout:

- By logging out in your app. In this case you SHOULD notify the IdP first so it'll close the global session.
- By logging out of the global SSO Session. In this case the IdP will notify you on `/saml2/{uuid}/sls` endpoint (already provided).

For the first case, call `Saml2Auth::logout();` or redirect the user to the route `saml.logout` which does just that. Do not close the session immediately as you need to receive a response confirmation from the IdP (redirection). That response will be handled by the library at `/saml2/{uuid}/sls` and will fire an event for you to complete the operation.

For the second case you will only receive the event. Both cases receive the same event.

Note that for the second case, you may have to manually save your session to make the logout stick (as the session is saved by middleware, but the OneLogin library will redirect back to your IdP before that happens):

```
Event::listen('Slides\Saml2\Events\SignedOut', function (SignedOut $event) {
    Auth::logout();
    Session::save();
});
```

### SSO-friendly links

[](#sso-friendly-links)

Sometimes, you need to create links to your application with support of SSO lifecycle. It means you expect a user to be signed in once you click on that link.

The most popular example is generating links from emails, where you need to make sure when user goes to your application from email, he will be logged in. To solve this issue, you can use helpers that allow you create SSO-friendly routes and URLs — `saml_url()` and `saml_route()`.

To generate a link, you need to call one of functions and pass UUID of the tenant as a second parameter, unless your session knows that user was resolved by SSO.

> To retrieve UUID based on user, you should implement logic that links your internal user to a tenant.

Then, it generates a link like this:

```
https://yourdomain/saml/63fffdd1-f416-4bed-b3db-967b6a56896b/login?returnTo=https://yourdomain.com/your/actual/link

```

Basically, when user clicks on a link, it initiates SSO login process and redirects it back to your needed URL.

Examples
--------

[](#examples)

### Azure AD

[](#azure-ad)

At this point, we assume you have an application on Azure AD that supports Single Sign On.

##### Step 1. Retrieve Identity Provider credentials

[](#step-1-retrieve-identity-provider-credentials)

[![Azure AD](https://camo.githubusercontent.com/9e25a97344b90b27d5f10460fce273a5258ca3e3c0618b5e50b4833ab8c19e2b/68747470733a2f2f692e696d6775722e636f6d2f784b4c737778422e706e67)](https://camo.githubusercontent.com/9e25a97344b90b27d5f10460fce273a5258ca3e3c0618b5e50b4833ab8c19e2b/68747470733a2f2f692e696d6775722e636f6d2f784b4c737778422e706e67)

You need to retrieve the following parameters:

- Login URL
- Azure AD Identifier
- Logout URL
- Certificate (Base64)

##### Step 2. Create a Tenant

[](#step-2-create-a-tenant)

Based on information you received below, create a Tenant, like this:

```
php artisan saml2:create-tenant \
  --key=azure_testing \
  --entityId=https://sts.windows.net/fb536a7a-7251-4895-a09a-abd8e614c70b/ \
  --loginUrl=https://login.microsoftonline.com/fb536a7a-7251-4895-a09a-abd8e614c70b/saml2 \
  --logoutUrl=https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0 \
  --x509cert="MIIC0jCCAbqgAw...CapVR4ncDVjvbq+/S" \
  --metadata="customer:11235,anotherfield:value" // you might add some customer parameters here to simplify logging in your customer afterwards

```

Once you successfully created the tenant, you will receive the following output:

```
The tenant #1 (63fffdd1-f416-4bed-b3db-967b6a56896b) was successfully created.

Credentials for the tenant
--------------------------

 Identifier (Entity ID): https://yourdomain.com/saml/63fffdd1-f416-4bed-b3db-967b6a56896b/metadata
 Reply URL (Assertion Consumer Service URL): https://yourdomain.com/saml/63fffdd1-f416-4bed-b3db-967b6a56896b/acs
 Sign on URL: https://yourdomain.com/saml/63fffdd1-f416-4bed-b3db-967b6a56896b/login
 Logout URL: https://yourdomain.com/saml/63fffdd1-f416-4bed-b3db-967b6a56896b/logout
 Relay State: / (optional)

```

##### Step 3. Configure Identity Provider

[](#step-3-configure-identity-provider)

Using the output below, assign parameters to your IdP on application Single-Sign-On settings page.

[![Azure AD](https://camo.githubusercontent.com/2184746b3850950da5929d6200916d41d3ee2ae2ee8701c83a49933574adcc61/68747470733a2f2f692e696d6775722e636f6d2f33686b6a464c5a2e706e67)](https://camo.githubusercontent.com/2184746b3850950da5929d6200916d41d3ee2ae2ee8701c83a49933574adcc61/68747470733a2f2f692e696d6775722e636f6d2f33686b6a464c5a2e706e67)

##### Step 4. Make sure your application accessible by Azure AD

[](#step-4-make-sure-your-application-accessible-by-azure-ad)

Test your application directly from Azure AD and make sure it's accessible worldwide.

###### Running locally

[](#running-locally)

If you want to test it locally, you may use [ngrok](https://ngrok.com/).

In case if you have a problem with URL creation in your application, you can overwrite host header in your nginx host config file by adding the following parameters:

```
fastcgi_param HTTP_HOST your.ngrok.io;
fastcgi_param HTTPS on;

```

> Replace `your.ngrok.io` with your actual ngrok URL

Tests
-----

[](#tests)

Run the following in the package folder:

```
vendor/bin/phpunit

```

Security
--------

[](#security)

This fork is maintained by Scaler Tech. Please report vulnerabilities through GitHub Security Advisories in this repository.

Credits
-------

[](#credits)

- Repository: [scaler-tech/laravel-saml2](https://github.com/scaler-tech/laravel-saml2)
- Original authors: [brezzhnev](https://github.com/brezzhnev), [aacotroneo](https://github.com/aacotroneo)
- Current maintainers: [Scaler Tech](https://github.com/scaler-tech)
- [All Contributors](https://github.com/scaler-tech/laravel-saml2/contributors)

License
-------

[](#license)

The MIT License (MIT). Please see [LICENSE](LICENSE) for more information.

###  Health Score

66

—

FairBetter than 99% of packages

Maintenance83

Actively maintained with recent releases

Popularity63

Solid adoption and visibility

Community34

Small or concentrated contributor base

Maturity71

Established project with proven stability

 Bus Factor2

2 contributors hold 50%+ of commits

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~93 days

Recently: every ~85 days

Total

44

Last Release

93d ago

Major Versions

0.11.1 → 1.0.02018-11-08

1.2.0 → 2.0.02019-06-26

2.4.0 → 3.x-dev2024-04-13

PHP version history (4 changes)0.0.1PHP >=5.4.0

1.1.1PHP >=7.0

2.0.1PHP >=7.1

3.x-devPHP >=7.3

### Community

Maintainers

![](https://www.gravatar.com/avatar/ba1bb38989827a8ea99a9549351c462615046a47ee9aee3bff262a7737130950?d=identicon)[scaler-tech](/maintainers/scaler-tech)

---

Top Contributors

[![aacotroneo](https://avatars.githubusercontent.com/u/10578291?v=4)](https://github.com/aacotroneo "aacotroneo (90 commits)")[![breart](https://avatars.githubusercontent.com/u/9466810?v=4)](https://github.com/breart "breart (86 commits)")[![alexander-tebiev](https://avatars.githubusercontent.com/u/120428878?v=4)](https://github.com/alexander-tebiev "alexander-tebiev (35 commits)")[![beeyev](https://avatars.githubusercontent.com/u/326840?v=4)](https://github.com/beeyev "beeyev (12 commits)")[![vopolonc](https://avatars.githubusercontent.com/u/44755807?v=4)](https://github.com/vopolonc "vopolonc (8 commits)")[![RobertBoes](https://avatars.githubusercontent.com/u/2871897?v=4)](https://github.com/RobertBoes "RobertBoes (7 commits)")[![dmyers](https://avatars.githubusercontent.com/u/207171?v=4)](https://github.com/dmyers "dmyers (5 commits)")[![aguinaldotupy](https://avatars.githubusercontent.com/u/44652991?v=4)](https://github.com/aguinaldotupy "aguinaldotupy (5 commits)")[![danmichaelo](https://avatars.githubusercontent.com/u/434495?v=4)](https://github.com/danmichaelo "danmichaelo (4 commits)")[![soltmar](https://avatars.githubusercontent.com/u/14175459?v=4)](https://github.com/soltmar "soltmar (3 commits)")[![omitobi](https://avatars.githubusercontent.com/u/16482234?v=4)](https://github.com/omitobi "omitobi (3 commits)")[![abublihi](https://avatars.githubusercontent.com/u/10172039?v=4)](https://github.com/abublihi "abublihi (2 commits)")[![matijakovacevic](https://avatars.githubusercontent.com/u/2469719?v=4)](https://github.com/matijakovacevic "matijakovacevic (2 commits)")[![snipe](https://avatars.githubusercontent.com/u/197404?v=4)](https://github.com/snipe "snipe (2 commits)")[![perifer](https://avatars.githubusercontent.com/u/34488?v=4)](https://github.com/perifer "perifer (2 commits)")[![darynmitchell](https://avatars.githubusercontent.com/u/3178872?v=4)](https://github.com/darynmitchell "darynmitchell (2 commits)")[![r-senchuk](https://avatars.githubusercontent.com/u/5601288?v=4)](https://github.com/r-senchuk "r-senchuk (2 commits)")[![s3sam](https://avatars.githubusercontent.com/u/25058465?v=4)](https://github.com/s3sam "s3sam (2 commits)")[![BrendanTWhite](https://avatars.githubusercontent.com/u/2833789?v=4)](https://github.com/BrendanTWhite "BrendanTWhite (2 commits)")[![olivM](https://avatars.githubusercontent.com/u/855?v=4)](https://github.com/olivM "olivM (1 commits)")

---

Tags

laraveloneloginsaml-service-providersaml2ssolaravelSSOsamlSAML2onelogin

###  Code Quality

TestsPHPUnit

Code StylePHP\_CodeSniffer

### Embed Badge

![Health badge](/badges/24slides-laravel-saml2/health.svg)

```
[![Health](https://phpackages.com/badges/24slides-laravel-saml2/health.svg)](https://phpackages.com/packages/24slides-laravel-saml2)
```

###  Alternatives

[scaler-tech/laravel-saml2

SAML2 Service Provider integration for Laravel applications, based on OneLogin toolkit

2737.5k](/packages/scaler-tech-laravel-saml2)[aacotroneo/laravel-saml2

A Laravel package for Saml2 integration as a SP (service provider) for multiple IdPs, based on OneLogin toolkit which is much more lightweight than simplesamlphp.

5704.4M](/packages/aacotroneo-laravel-saml2)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)