Laravel SAML IdP

By default, the package sends ClaimTypes::EMAIL_ADDRESS (from auth()->user()->email) and ClaimTypes::GIVEN_NAME (from auth()->user()->name).

To send additional attributes, subscribe to the CodeGreenCreative\SamlIdp\Events\Assertion event in your EventServiceProvider and create a listener that interacts with the $event->attribute_statement.

// App	ext
// In EventServiceProvider.php
protected $listen = [
    'CodeGreenCreative\SamlIdp\Events\Assertion' => [
        'App\Listeners\SamlAssertionAttributes',
    ]
];

// App
// In SamlAssertionAttributes.php
public function handle(Assertion $event)
{
    $event->attribute_statement
        ->addAttribute(new Attribute(ClaimTypes::PPID, auth()->user()->id))
        ->addAttribute(new Attribute(ClaimTypes::NAME, auth()->user()->name));
}

Install the package via Composer to implement a SAML 2.0 Identity Provider (IdP) in your Laravel application.

composer require codegreencreative/laravel-samlidp

Publish the package configuration file to your application's config directory.

After publishing, you must also configure a filesystem disk named samlidp to handle certificate storage.

php artisan vendor:publish --tag="samlidp_config"

// config/filesystem.php

'disks' => [
    ...
    'samlidp' => [
        'driver' => 'local',
        'root' => storage_path() . '/samlidp',
    ]
],

Instead of hardcoding SPs in a config file, you can store them in a database.

1. Run the migrations: php artisan migrate.
2. Update config/samlidp.php to point to the SamlServiceProvider model.

// config/samlidp.php

return [
    // ...
    'sp' => \CodeGreenCreative\SamlIdp\Models\SamlServiceProvider::class,
    // ...
];

Log out of IdP after SLO

To ensure the user is logged out of the IdP session after the Service Provider Single Logout (SLO) is complete, set LOGOUT_AFTER_SLO=true in your .env file.

Redirect to SLO initiator after logout

To redirect the user back to the original Service Provider after all SPs have been logged out, use the sp_slo_redirects option in config/samlidp.php. The key should be the beginning of the HTTP_REFERER value, and the value should be the full redirect URL.

Example usage: https://idp.com/saml/logout?return_to=mysp.com

// .env
LOGOUT_AFTER_SLO=true

// config/samlidp.php
return [
    'sp_slo_redirects' => [
        'mysp.com' => 'https://mysp.com',
    ],
];

You can define the digital digest algorithm used by the IdP in config/samlidp.php. This uses constants from the \RobRichards\XMLSecLibs\XMLSecurityDSig class.

return [
    'digest_algorithm' => \RobRichards\XMLSecLibs\XMLSecurityDSig::SHA1,
];

Service Providers are defined in config/samlidp.php. The key for each SP must be the Base64 encoded Consumer Service (ACS) URL.

You can use php artisan samlidp:sp to help generate a new SP configuration entry.

return [
    'login_uri' => 'login',
    'issuer_uri' => 'saml/metadata',
    'sp' => [
        // Base64 encoded ACS URL
        'aHR0cHM6Ly9teWZhY2Vib29rd29ya3BsYWNlLmZhY2Vib29rLmNvbS93b3JrL3NhbWwucGhw' => [
            'destination' => 'https://example.com/saml/acs',
            'logout' => 'https://example.com/saml/sls',
            // 'certificate' => '',
            // 'query_params' => false,
            // 'encrypt_assertion' => false
        ],
    ],
    'guards' => ['web'],
];

To customize the SAML IdP behavior or the UI, you can publish the configuration file and the Blade views to your application's resource directories using the following Artisan commands:

• To publish the configuration file: php artisan vendor:publish --tag=samlidp_config
• To publish the views: php artisan vendor:publish --tag=samlidp_views

# Publish configuration
php artisan vendor:publish --tag=samlidp_config

# Publish views
php artisan vendor:publish --tag=samlidp_views

You can provide the Service Provider's certificate in three ways within the sp configuration array:

1. As a raw string: Provide the PEM-formatted string directly.
2. Via environment variable: Use env() to pull from .env.
3. From a file: Use the file:// prefix followed by the absolute path.

// 1. String
'certificate' => "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"

// 2. Env variable
'certificate' => env('SAML_SP_CERTIFICATE', '')

// 3. File path
'certificate' => 'file://' . storage_path('samlidp/service-provider.pem')

To include custom user attributes in the SAML assertion sent to a Service Provider, listen for the CodeGreenCreative\SamlIdp\Events\Assertion event. The event provides access to the AttributeStatement object, which you can populate with your own data.

Implementation Example

In your EventServiceProvider or a dedicated listener:

use CodeGreenCreative\SamlIdp\Events\Assertion as AssertionEvent;
use LightSaml\Model\Assertion\AttributeStatement;
use LightSaml\Model\Assertion\Attribute;

// Inside your register or boot method
Event::listen(AssertionEvent::class, function (AssertionEvent $event) {
    /** @var AttributeStatement $attributeStatement */
    $attributeStatement = $event->attributeStatement;
    /** @var \\